macwarden 1.1.0 → 1.1.1

package/dist/runtime.js

@@ -5,22 +5,23 @@ import * as builtin3 from "node:path";
 import * as builtin4 from "node:stream";
 import * as builtin5 from "node:crypto";
 import * as builtin6 from "node:child_process";
-import * as builtin7 from "node:os";
-import * as builtin8 from "node:readline";
-import * as builtin9 from "node:util";
+import * as builtin7 from "node:readline";
+import * as builtin8 from "node:util";
+import * as builtin9 from "node:os";
 import * as builtin10 from "node:http2";
 import * as builtin11 from "node:https";
-const builtins = {"node:fs": builtin0,"node:fs/promises": builtin1,"node:async_hooks": builtin2,"node:path": builtin3,"node:stream": builtin4,"node:crypto": builtin5,"node:child_process": builtin6,"node:os": builtin7,"node:readline": builtin8,"node:util": builtin9,"node:http2": builtin10,"node:https": builtin11};
+const builtins = {"node:fs": builtin0,"node:fs/promises": builtin1,"node:async_hooks": builtin2,"node:path": builtin3,"node:stream": builtin4,"node:crypto": builtin5,"node:child_process": builtin6,"node:readline": builtin7,"node:util": builtin8,"node:os": builtin9,"node:http2": builtin10,"node:https": builtin11};
 const factories = {"bounded-file.js": (module, exports, require) => {
 "use strict";
 exports.__esModule = true;
 exports.LOCK_FILE_LIMIT = exports.DEFAULT_FILE_LIMIT = exports.BoundedFileError = void 0;
 exports.readBounded = readBounded;
 exports.readBoundedFile = readBoundedFile;
-exports.assertPlainFile = assertPlainFile;
-// Bounded regular-file reads for files macwarden reads by path: TLS certificates and the
-// sidecars kept next to the registry. The path and its resolved target are checked against
-// the protected names (SAFE-02) before anything is opened, the opened file must be the
+exports.readPlainFile = readPlainFile;
+// Bounded regular-file reads for files macwarden reads by path: TLS certificates, the
+// sidecars kept next to the registry and lock owner records. The path (and, except for lock
+// records, which must not be symlinks, its resolved target) is checked against the
+// protected names (SAFE-02) before anything is opened, the opened file must be the
 // regular file that was checked, and at most `limit` bytes are accepted: a larger file fails
 // before its content is parsed, and allocation follows the file's size, never the limit.
 const node_fs_1 = require("node:fs");
@@ -94,18 +95,39 @@ async function readBoundedFile(path, io, limit = exports.DEFAULT_FILE_LIMIT) {
 /** Largest lock owner record read: a few fields (pid, host name, start time, process domain). */
 exports.LOCK_FILE_LIMIT = 64 * 1024;
 /**
- * For files read by whole-file reads that must stay in place (lock owner records, whose
- * reads are part of the lock protocol): the path itself must be a regular file, not a
- * symlink, under no protected name, and at most `limit` bytes. Refuses before any open.
+ * Reads a file that must stay in place (lock owner records, whose reads are part of the lock
+ * protocol) through one descriptor: the path itself must be a regular file, not a symlink,
+ * under no protected name and at most `limit` bytes when checked; the opened file must be
+ * that same regular file (device and inode, compared as bigints so Windows file indexes stay
+ * exact; no-follow is used where the platform has it, and Windows has none, so the identity
+ * check is what binds the read to the checked file), and at most limit + 1 bytes are read
+ * from it. A symlink or protected path is refused before any open; a file replaced after the
+ * check is refused before its content is read; one that grew past `limit` fails once
+ * limit + 1 bytes have been read.
  */
-async function assertPlainFile(path, io, limit) {
+async function readPlainFile(path, io, limit) {
     if ((0, protected_path_js_1.isProtectedPath)(path))
         throw new BoundedFileError('protected file');
-    const meta = await io.lstat(path);
+    const meta = await io.lstat(path, { bigint: true });
     if (!meta.isFile() || meta.isSymbolicLink())
         throw new BoundedFileError('not a regular file');
-    if (meta.size > limit)
+    if (meta.size > BigInt(limit))
         throw new BoundedFileError('file too large');
+    const handle = await io.open(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NONBLOCK ?? 0) | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = await handle.stat({ bigint: true });
+        if (!opened.isFile() || opened.dev !== meta.dev || opened.ino !== meta.ino)
+            throw new BoundedFileError('file changed');
+        if (opened.size > BigInt(limit))
+            throw new BoundedFileError('file too large');
+        const bytes = await readBounded(handle, limit, opened.size);
+        if (bytes.length > limit)
+            throw new BoundedFileError('file too large');
+        return bytes.toString('utf8');
+    }
+    finally {
+        await handle.close();
+    }
 }
 
 },
@@ -445,11 +467,28 @@ async function main(argv) {
             process.stdout.write((0, index_js_1.render)({ command: null, ok: true, warnings: [], result: { text: packageVersion() }, error: null }, 'text'));
             return 0;
         }
+        if (argv.length === 2 && argv.includes('--help') && argv.includes('--json')) {
+            // Top-level help as one JSON document (MW110-10); schemas/output/macwarden.schema.json.
+            const help = { command: null, ok: true, warnings: [], result: {
+                    usage: usage.split('\n').slice(0, 3).map(line => line.replace(/^(?:Usage: | +)/, '')),
+                    commands: summaries.map(([name, summary]) => ({ name, summary }))
+                }, error: null };
+            await write(help, 'json');
+            return 0;
+        }
         if (argv.length === 1 && argv[0] === '--help') {
             process.stdout.write((0, index_js_1.render)(textResult(usage), 'text'));
             return 0;
         }
         if (command && argv.slice(1, flagsEnd).includes('--help')) {
+            // With --json, help is one JSON document like every other output (MW110-10).
+            if (mode === 'json') {
+                // Rendered only as JSON, so it goes through the same JSON writer without a per-command result type.
+                const help = { command, ok: true, warnings: [], result: { usage: synopses[command].map(line => `macwarden ${line}`) },
+                    error: null };
+                await write(help, 'json');
+                return 0;
+            }
             process.stdout.write((0, index_js_1.render)(textResult(commandUsage(command)), 'text'));
             return 0;
         }
@@ -562,6 +601,7 @@ const index_js_2 = require("../grade/index.js");
 const index_js_3 = require("../input/index.js");
 const protected_path_js_1 = require("../protected-path.js");
 const write_out_js_1 = require("./bake/write-out.js");
+const out_errors_js_1 = require("./bake/out-errors.js");
 const valueFlags = new Set(['--out', '--expires', '--ip', '--ip-range']);
 const switchFlags = new Set(['--dry-run', '--unsafe-arg', '--json']);
 function fail(code, step, message, warnings = []) {
@@ -670,6 +710,9 @@ async function runSteps(args, deps, state) {
     // A3: the output must be a new, unprotected path.
     if ((0, protected_path_js_1.isProtectedPath)(request.out))
         return fail(3, 'A3', 'protected output path');
+    const outName = (0, protected_path_js_1.outputNameProblem)(request.out);
+    if (outName)
+        return fail(3, 'A3', `output path refused: ${outName}`);
     let outPath;
     try {
         outPath = await (0, protected_path_js_1.resolveUnprotectedPath)(request.out, deps.fs);
@@ -741,8 +784,8 @@ async function runSteps(args, deps, state) {
             if (reserved.aclWarning)
                 warnings.push('acl-best-effort');
         }
-        catch {
-            return fail(3, 'A6', 'cannot create output file', warnings);
+        catch (error) {
+            return fail(3, 'A6', (0, out_errors_js_1.reserveFailure)(error, 'cannot create output file'), warnings);
         }
         (0, cancellation_js_1.checkCancellation)();
         try {
@@ -845,6 +888,7 @@ const process_error_context_js_1 = require("../../process-error-context.js");
 const index_js_4 = require("../../registry/index.js");
 const errors_js_1 = require("../../errors.js");
 const write_out_js_1 = require("./write-out.js");
+const out_errors_js_1 = require("./out-errors.js");
 const allocate_js_1 = require("./allocate.js");
 const canary_js_1 = require("../../watch/canary.js");
 // A canary looks like an ordinary read-only credential. Its default permissions cover the
@@ -911,15 +955,15 @@ function parse(args, env) {
     const raw = get('--permissions');
     const uri = get('--uri');
     const expires = get('--expires');
-    const host = get('--lnd-rest') ?? env.MACWARDEN_LND_REST;
-    const cert = get('--tls-cert') ?? env.MACWARDEN_TLS_CERT;
-    const own = get('--macaroon') ?? env.MACWARDEN_MACAROON;
+    const { host, cert, own, problem: mixedSource } = (0, online_js_1.connectionSettings)(get, env);
     if (!label)
         return '--label is required';
     if (!/^[A-Za-z][A-Za-z0-9._-]{0,63}$/.test(label))
         return `--label ${online_js_1.LABEL_RULE}`;
     if (!out)
         return '--out is required: the path of the new macaroon file';
+    if (mixedSource)
+        return mixedSource;
     const connection = (0, online_js_1.connectionProblem)(host, cert, own);
     if (connection)
         return connection;
@@ -975,6 +1019,9 @@ async function runSteps(args, deps, state) {
         return fail(2, 'B3', 'ADMIN permissions require --allow-admin');
     if ((0, protected_path_js_1.isProtectedPath)(request.out))
         return fail(3, 'B4', 'protected output path');
+    const outName = (0, protected_path_js_1.outputNameProblem)(request.out);
+    if (outName)
+        return fail(3, 'B4', `output path refused: ${outName}`);
     let outPath;
     try {
         outPath = await (0, protected_path_js_1.resolveUnprotectedPath)(request.out, deps.fs);
@@ -1067,8 +1114,8 @@ async function runSteps(args, deps, state) {
                 if (reserved.aclWarning)
                     warnings.push('acl-best-effort');
             }
-            catch {
-                return fail(3, 'B7', 'cannot reserve output file', warnings);
+            catch (error) {
+                return fail(3, 'B7', (0, out_errors_js_1.reserveFailure)(error), warnings);
             }
         }
         const adapter = deps.lnd ?? deps.createAdapter?.({ restUrl: request.host, tlsCert: cert, macaroon: own });
@@ -1113,14 +1160,34 @@ async function runSteps(args, deps, state) {
             fingerprint: null, outPath: null, createdAt, verified: false, status: 'active',
             revokedAt: null, revokeEvidence: null, replaces: null, replacedBy: null };
         (0, cancellation_js_1.checkCancellation)();
+        // The pending record may be on disk once save started (a failure after the rename, or a signal
+        // during it), although nothing was sent to LND: it is removed again before reporting, so exit 3
+        // and exit 6 keep meaning "nothing changed"; if the registry on disk still holds it, the exit
+        // is 7 and the message names it with its recovery (RL-08).
+        const unrecord = async (code, step, message) => {
+            try {
+                registry.removePending(pubkey, id);
+                await registry.save();
+                return fail(code, step, message, warnings);
+            }
+            catch { /* Decide from what is on disk. */ }
+            try {
+                if (!(await (0, index_js_4.openRegistry)(request.registry, { fs: deps.fs, env: deps.env })).find(pubkey, id))
+                    return fail(code, step, message, warnings);
+            }
+            catch { /* Unreadable: the record may remain. */ }
+            return fail(7, step, `${message}; nothing sent to LND, but the registry still holds (or may hold) the pending record for root key ${id}` +
+                `, which keeps the label in use; run macwarden inventory and, if it lists root key ${id}, ${(0, online_js_1.recoveryCommand)(request, id)}`, warnings);
+        };
         try {
             registry.add(entry);
             await registry.save();
         }
         catch {
-            return fail(3, 'B11', 'cannot record pending issued ID; nothing sent to LND', warnings);
+            return await unrecord(3, 'B11', 'cannot record pending issued ID; nothing sent to LND');
         }
-        (0, cancellation_js_1.checkCancellation)();
+        if ((0, cancellation_js_1.cancellationSignal)()?.aborted)
+            return await unrecord(6, 'cancelled', 'interrupted');
         let mac;
         state.mutationSent = true;
         (0, process_error_context_js_1.markMutationSent)();
@@ -1274,6 +1341,22 @@ async function bake(args) {
     return run(args, { fs: nodeFs, env: { ...process.env }, clock: () => new Date(), createAdapter: index_js_1.createLndAdapter });
 }
 
+},
+"commands/bake/out-errors.js": (module, exports, require) => {
+"use strict";
+exports.__esModule = true;
+exports.OutputReserveError = void 0;
+exports.reserveFailure = reserveFailure;
+/** A reservation failure whose message the commands show after "cannot reserve output file". */
+class OutputReserveError extends Error {
+    constructor(message) { super(message); this.name = 'OutputReserveError'; }
+}
+exports.OutputReserveError = OutputReserveError;
+/** The text a command prints for a failed output reservation. */
+function reserveFailure(error, fallback = 'cannot reserve output file') {
+    return error instanceof OutputReserveError ? `${fallback}: ${error.message}` : fallback;
+}
+
 },
 "commands/bake/write-out.js": (module, exports, require) => {
 "use strict";
@@ -1315,60 +1398,32 @@ exports.reserveOut = reserveOut;
 const secret_capability_js_1 = require("../../secret-capability.js");
 const nodeFs = __importStar(require("node:fs/promises"));
 const node_fs_1 = require("node:fs");
-const node_child_process_1 = require("node:child_process");
 const node_path_1 = require("node:path");
-const node_os_1 = require("node:os");
-const SID = /^S-1-\d+(?:-\d+)+$/;
+const protected_path_js_1 = require("../../protected-path.js");
+const node_child_process_1 = require("node:child_process");
+const out_errors_js_1 = require("./out-errors.js");
 // libuv's UV_FS_O_EXLOCK: on Windows the file is opened with share mode 0, so the
-// open fails while any other handle exists and no other handle can be opened while
-// it is held. Node does not export the constant; libuv passes it through.
+// open fails while any other handle with data access exists, and no such handle can
+// be opened while it is held. Node does not export the constant; libuv passes it through.
 const UV_FS_O_EXLOCK = 0x10000000;
-class OutputShareError extends Error {
-    constructor() { super('output file was opened by another process before it was restricted'); this.name = 'OutputShareError'; }
-}
-function run(file, args) {
-    return new Promise(resolve => {
-        (0, node_child_process_1.execFile)(file, args, { shell: false, windowsHide: true, timeout: 10_000 }, (error, stdout) => resolve({ ok: error === null, stdout: String(stdout ?? '') }));
-    });
-}
-/** The current user's SID from System32 whoami, or null when unavailable or malformed. */
-async function currentUserSid(systemRoot) {
-    const result = await run(node_path_1.win32.join(systemRoot, 'System32', 'whoami.exe'), ['/user', '/fo', 'csv', '/nh']);
-    if (!result.ok)
-        return null;
-    const fields = /^"[^"\r\n]*","([^"\r\n]*)"$/.exec(result.stdout.trim());
-    return fields && SID.test(fields[1]) ? fields[1] : null;
+class OutputShareError extends out_errors_js_1.OutputReserveError {
+    constructor() { super('output file was opened or replaced by another process before it was written'); this.name = 'OutputShareError'; }
 }
+/**
+ * Creates `path` exclusively for one credential (or report) and returns a reservation that
+ * writes it through a handle no other process holds. The file is owner-only before any byte
+ * is written, and that is verified; anything else fails before writing. `aclWarning` is true
+ * only on a Windows volume that stores no permissions (FAT, exFAT).
+ */
 async function reserveOut(path, fs = nodeFs) {
-    let handle = await fs.open(path, 'wx', 0o600);
+    const nameProblem = (0, protected_path_js_1.outputNameProblem)(path);
+    if (nameProblem)
+        throw new out_errors_js_1.OutputReserveError(nameProblem);
+    const reserved = process.platform === 'win32' ? await reserveWindows(path, fs) : await reservePosix(path, fs);
+    const handle = reserved.handle;
     let written = false;
-    let aclWarning = false;
-    if (process.platform === 'win32') {
-        try {
-            const systemRoot = process.env.SystemRoot ?? 'C:\\Windows';
-            if (!node_path_1.win32.isAbsolute(systemRoot))
-                throw new Error('invalid Windows system directory');
-            // Prefer the SID: account names fail to resolve for some account types,
-            // such as Microsoft and Entra ID accounts. Without a valid SID, use the
-            // account name. One icacls call either way; its failure is the warning.
-            const sid = await currentUserSid(systemRoot);
-            const user = (0, node_os_1.userInfo)().username;
-            const domain = process.env.USERDOMAIN;
-            const principal = sid ? `*${sid}:F` : domain ? `${domain}\\${user}:F` : `${user}:F`;
-            const applied = await run(node_path_1.win32.join(systemRoot, 'System32', 'icacls.exe'), [path, '/inheritance:r', '/grant:r', principal]);
-            aclWarning = !applied.ok;
-        }
-        catch {
-            aclWarning = true;
-        }
-        // Windows checks access only when a handle is opened, so a handle opened before
-        // icacls keeps its access. Replace the creation handle with an exclusive one: it
-        // cannot be opened while any other handle exists, so a successful open proves no
-        // other process holds the file, and none can open it until the bytes are written.
-        handle = await exclusiveReopen(path, handle, fs);
-    }
     return {
-        aclWarning,
+        aclWarning: reserved.aclWarning,
         reservation: {
             async write(mac) {
                 await handle.writeFile((0, secret_capability_js_1.revealSecret)(mac));
@@ -1390,31 +1445,225 @@ async function reserveOut(path, fs = nodeFs) {
         },
     };
 }
-async function exclusiveReopen(path, created, fs) {
-    let identity;
+// POSIX: create 0600 with O_EXCL, then prove the mode through the open descriptor. File
+// systems that cannot store modes (WSL drvfs, vfat, exFAT, CIFS) report other bits; chmod
+// is tried once and, if the file is still not private, it is removed and nothing is written.
+async function reservePosix(path, fs) {
+    const handle = await fs.open(path, 'wx', 0o600);
+    const uid = process.getuid?.();
+    const private_ = async () => {
+        const stat = await handle.stat();
+        return (stat.mode & 0o077) === 0 && (uid === undefined || stat.uid === uid);
+    };
+    try {
+        if (await private_())
+            return { handle, aclWarning: false };
+        await handle.chmod(0o600).catch(() => undefined);
+        if (await private_())
+            return { handle, aclWarning: false };
+    }
+    catch { /* checked below as not private */ }
     try {
-        identity = await created.stat({ bigint: true });
+        await handle.close();
     }
     finally {
-        await created.close();
+        await fs.unlink(path).catch(() => undefined);
     }
-    let exclusive;
+    throw new out_errors_js_1.OutputReserveError('the file system did not keep owner-only mode 0600; nothing was written');
+}
+// Windows: the fixed helper creates the file with an owner-only, protected DACL in the same
+// call that creates it, so no other principal is ever granted access and none can hold a
+// handle to it (not even one that only changes permissions). The file is then opened with
+// share mode 0, and the owner and DACL of the object at the path are read back while that
+// handle is held: the owner must be this user and the DACL must grant only this user.
+async function reserveWindows(path, fs) {
+    const systemRoot = process.env.SystemRoot ?? 'C:\\Windows';
+    if (!node_path_1.win32.isAbsolute(systemRoot))
+        throw new out_errors_js_1.OutputReserveError('invalid Windows system directory');
+    const creation = await createPrivateFile(path, systemRoot);
+    if (!creation)
+        throw new out_errors_js_1.OutputReserveError('could not create the file with owner-only permissions');
+    let handle;
     try {
-        exclusive = await fs.open(path, node_fs_1.constants.O_RDWR | UV_FS_O_EXLOCK);
+        handle = await fs.open(path, node_fs_1.constants.O_RDWR | UV_FS_O_EXLOCK);
     }
     catch {
-        // Another handle exists (EBUSY) or the file changed: the reservation is unsafe.
-        // Nothing has been written; remove the empty file and fail.
+        // Another handle exists (EBUSY) or the file is gone. Nothing has been written.
+        creation.end();
         await fs.unlink(path).catch(() => undefined);
         throw new OutputShareError();
     }
-    const reopened = await exclusive.stat({ bigint: true }).catch(() => null);
-    if (!reopened || reopened.dev !== identity.dev || reopened.ino !== identity.ino) {
-        // A different file now has this name; do not write to it or delete it.
-        await exclusive.close();
+    // FAT and exFAT keep no owner and no ACL, so there is nothing to verify.
+    if (creation.noAcl) {
+        creation.end();
+        return { handle, aclWarning: true };
+    }
+    const found = await creation.verify();
+    if (!found || found.owner !== creation.sid) {
+        // Not provably the file the helper created: do not write to it or delete it.
+        await handle.close();
         throw new OutputShareError();
     }
-    return exclusive;
+    if (!ownerOnly(found, creation.sid)) {
+        try {
+            await handle.close();
+        }
+        finally {
+            await fs.unlink(path).catch(() => undefined);
+        }
+        throw new out_errors_js_1.OutputReserveError('the file did not keep owner-only permissions (another account has access); nothing was written');
+    }
+    return { handle, aclWarning: false };
+}
+const SID = /^S-1-\d+(?:-\d+)+$/;
+// The fixed helper creates the file with CreateNew and a security descriptor that is
+// private from the first instant: owner = this user, a protected DACL (nothing inherited)
+// and one ACE granting this user full control. No other principal is ever granted access,
+// so none can open a handle to the file, including one that only changes its permissions.
+// The path arrives through the environment, never through the command text.
+const helperScript = String.raw `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+function Describe($sec) {
+  $owner = $sec.GetOwner([Security.Principal.SecurityIdentifier])
+  $rules = @($sec.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier]) | ForEach-Object {
+    @{ sid = $_.IdentityReference.Value; allow = ($_.AccessControlType -eq 'Allow'); inherited = $_.IsInherited; rights = [int64]$_.FileSystemRights } })
+  return @{ owner = $(if ($owner) { $owner.Value } else { $null }); protected = $sec.AreAccessRulesProtected; rules = $rules }
+}
+try {
+  $path = $env:MACWARDEN_PRIVATE_OUT
+  $me = [Security.Principal.WindowsIdentity]::GetCurrent().User
+  # FAT and exFAT volumes store no Windows permissions at all.
+  $noAcl = $false
+  try { $noAcl = (New-Object IO.DriveInfo([IO.Path]::GetPathRoot($path))).DriveFormat -match '^(FAT|FAT12|FAT16|FAT32|exFAT)$' } catch { $noAcl = $false }
+  if ($noAcl) {
+    $stream = New-Object IO.FileStream($path, [IO.FileMode]::CreateNew, [IO.FileAccess]::ReadWrite, [IO.FileShare]::None)
+    $stream.Dispose(); $created = $null
+  } else {
+    $sec = New-Object Security.AccessControl.FileSecurity
+    $sec.SetOwner($me)
+    $sec.SetAccessRuleProtection($true, $false)
+    $sec.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($me, [Security.AccessControl.FileSystemRights]::FullControl, [Security.AccessControl.AccessControlType]::Allow)))
+    $stream = New-Object IO.FileStream($path, [IO.FileMode]::CreateNew, [Security.AccessControl.FileSystemRights]::FullControl, [IO.FileShare]::None, 4096, [IO.FileOptions]::None, $sec)
+    try { $created = Describe $stream.GetAccessControl() } catch { $created = @{ unreadable = $true } } finally { $stream.Dispose() }
+  }
+} catch { [Console]::Out.WriteLine('FAILED'); exit 1 }
+[Console]::Out.WriteLine('CREATED ' + (@{ sid = $me.Value; noAcl = $noAcl; acl = $created } | ConvertTo-Json -Compress -Depth 4)); [Console]::Out.Flush()
+if ([Console]::In.ReadLine() -ne 'verify') { exit 0 }
+try { $found = Describe ([IO.File]::GetAccessControl($path, [Security.AccessControl.AccessControlSections]'Owner, Access')) } catch { $found = $null }
+[Console]::Out.WriteLine('VERIFIED ' + (@{ acl = $found } | ConvertTo-Json -Compress -Depth 4)); [Console]::Out.Flush()
+`;
+function parseAcl(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const record = value;
+    const rules = Array.isArray(record.rules) ? record.rules : record.rules && typeof record.rules === 'object' ? [record.rules] : null;
+    if (!rules || typeof record.protected !== 'boolean')
+        return null;
+    const parsed = [];
+    for (const rule of rules) {
+        if (!rule || typeof rule.sid !== 'string' || typeof rule.allow !== 'boolean'
+            || typeof rule.inherited !== 'boolean' || typeof rule.rights !== 'number')
+            return null;
+        parsed.push({ sid: rule.sid, allow: rule.allow, inherited: rule.inherited, rights: rule.rights });
+    }
+    return { owner: typeof record.owner === 'string' ? record.owner : null, protected: record.protected, rules: parsed };
+}
+/** True when the ACL grants only `sid`, nothing is inherited, and `sid` owns the object. */
+function ownerOnly(acl, sid) {
+    return !!acl && acl.owner === sid && acl.protected && acl.rules.length > 0
+        && acl.rules.every(rule => rule.sid === sid && rule.allow && !rule.inherited);
+}
+/**
+ * Creates `path` (which must not exist) with an owner-only security descriptor through the
+ * fixed System32 PowerShell helper, then keeps the helper waiting so the caller can verify
+ * the object at the path after opening it exclusively. Null when the helper did not report
+ * a created file (the path already existed, or the helper is unavailable or failed).
+ */
+function createPrivateFile(path, systemRoot) {
+    const executable = node_path_1.win32.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    return new Promise(resolve => {
+        let buffered = '';
+        let exited = false;
+        const waiting = [];
+        const complete = (prefix) => buffered.split(/\r?\n/).slice(0, -1).find(line => line.startsWith(prefix));
+        const deliver = () => {
+            for (const item of [...waiting]) {
+                const line = complete(item.prefix);
+                if (line !== undefined || exited) {
+                    waiting.splice(waiting.indexOf(item), 1);
+                    item.settle(line === undefined ? null : line.slice(item.prefix.length));
+                }
+            }
+        };
+        const next = (prefix) => new Promise(settle => { waiting.push({ prefix, settle }); deliver(); });
+        let child;
+        try {
+            child = (0, node_child_process_1.execFile)(executable, ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand',
+                Buffer.from(helperScript, 'utf16le').toString('base64')], {
+                shell: false, windowsHide: true, timeout: 20_000, maxBuffer: 64 * 1024, encoding: 'utf8',
+                env: { SystemRoot: systemRoot, WINDIR: systemRoot, PATH: node_path_1.win32.join(systemRoot, 'System32'),
+                    PSModulePath: node_path_1.win32.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'Modules'),
+                    MACWARDEN_PRIVATE_OUT: path },
+            }, (_error, stdout) => {
+                // The callback carries the complete output; streamed chunks may not all have arrived.
+                if (typeof stdout === 'string' && stdout.length > buffered.length)
+                    buffered = stdout;
+                buffered += '\n';
+                exited = true;
+                deliver();
+            });
+        }
+        catch {
+            child = undefined;
+        }
+        if (!child?.stdout || !child.stdin) {
+            resolve(null);
+            return;
+        }
+        const stdin = child.stdin;
+        stdin.on('error', () => undefined);
+        child.stdout.on('data', (chunk) => { if (!exited) {
+            buffered += String(chunk);
+            deliver();
+        } });
+        const end = () => { try {
+            stdin.end();
+        }
+        catch { /* the helper already exited */ } };
+        void next('CREATED ').then(line => {
+            let reply;
+            try {
+                reply = line === null ? null : JSON.parse(line);
+            }
+            catch {
+                reply = null;
+            }
+            if (!reply || typeof reply.sid !== 'string' || !SID.test(reply.sid)) {
+                end();
+                resolve(null);
+                return;
+            }
+            let verified;
+            resolve({ sid: reply.sid, noAcl: reply.noAcl === true, created: parseAcl(reply.acl), end,
+                verify: () => verified ??= (async () => {
+                    try {
+                        stdin.write('verify\n');
+                    }
+                    catch {
+                        return null;
+                    }
+                    const found = await next('VERIFIED ');
+                    end();
+                    try {
+                        return found === null ? null : parseAcl(JSON.parse(found).acl);
+                    }
+                    catch {
+                        return null;
+                    }
+                })() });
+        });
+    });
 }
 
 },
@@ -1624,6 +1873,7 @@ const usage_js_1 = require("../watch/usage.js");
 const access_review_js_1 = require("../report/access-review.js");
 const version_js_1 = require("../version.js");
 const write_out_js_1 = require("./bake/write-out.js");
+const out_errors_js_1 = require("./bake/out-errors.js");
 const methods = [
     ['/lnrpc.Lightning/GetInfo', 'info:read'],
     ['/lnrpc.Lightning/ListPermissions', 'info:read'],
@@ -1707,9 +1957,14 @@ async function runSteps(args, deps) {
         return fail(2, null, '--out needs --report <format>');
     if (reportOut !== undefined && (0, protected_path_js_1.isProtectedPath)(reportOut))
         return fail(3, 'N7', 'protected report path');
-    const host = supplied['--lnd-rest'] ?? deps.env.MACWARDEN_LND_REST;
-    const certPath = supplied['--tls-cert'] ?? deps.env.MACWARDEN_TLS_CERT;
-    const ownPath = supplied['--macaroon'] ?? deps.env.MACWARDEN_MACAROON;
+    const reportName = reportOut === undefined ? null : (0, protected_path_js_1.outputNameProblem)(reportOut);
+    if (reportName)
+        return fail(3, 'N7', `report path refused: ${reportName}`);
+    const settings = (0, online_js_1.connectionSettings)(flag => supplied[flag], deps.env);
+    if (settings.problem)
+        return fail(2, null, settings.problem);
+    // connectionProblem below refuses a missing setting before either path is used.
+    const host = settings.host, certPath = settings.cert, ownPath = settings.own;
     const connection = (0, online_js_1.connectionProblem)(host, certPath, ownPath);
     if (connection)
         return fail(2, null, connection);
@@ -1935,8 +2190,8 @@ async function runSteps(args, deps) {
                 throw error;
             }
         }
-        catch {
-            return fail(3, 'N7', 'cannot write report file', warnings);
+        catch (error) {
+            return fail(3, 'N7', (0, out_errors_js_1.reserveFailure)(error, 'cannot write report file'), warnings);
         }
         path = (0, node_path_1.resolve)(reportOut);
     }
@@ -2009,6 +2264,7 @@ const online_js_1 = require("../online.js");
 const index_js_3 = require("../output/index.js");
 const protected_path_js_1 = require("../protected-path.js");
 const index_js_4 = require("../registry/index.js");
+const root_key_id_js_1 = require("../root-key-id.js");
 const usage_js_1 = require("../watch/usage.js");
 function fail(code, step, message, warnings = []) {
     return { schema: 1, command: 'recommend', ok: false, warnings, result: null, error: { code, step, message } };
@@ -2054,12 +2310,12 @@ async function runSteps(args, deps) {
         return fail(2, 'R1', 'give exactly one label, root key ID or credential ID (id:…), or --target-file <file>');
     const selector = operands[0] ?? '';
     const byCredential = /^id:[0-9a-f]{16}$/.test(selector);
-    const byId = /^(0|[1-9][0-9]{0,19})$/.test(selector);
+    const byId = (0, root_key_id_js_1.isRootKeyId)(selector);
     if (targetFile === undefined && !byCredential && !byId && !/^[A-Za-z][A-Za-z0-9._-]{0,63}$/.test(selector))
         return fail(2, 'R1', 'selector must be a label, a root key ID or id:<16 hex>');
-    const host = flags.get('--lnd-rest') ?? deps.env.MACWARDEN_LND_REST;
-    const certPath = flags.get('--tls-cert') ?? deps.env.MACWARDEN_TLS_CERT;
-    const ownPath = flags.get('--macaroon') ?? deps.env.MACWARDEN_MACAROON;
+    const { host, cert: certPath, own: ownPath, problem: mixedSource } = (0, online_js_1.connectionSettings)(flag => flags.get(flag), deps.env);
+    if (mixedSource)
+        return fail(2, 'R1', mixedSource);
     if (!host)
         return fail(2, 'R1', 'missing --lnd-rest (or MACWARDEN_LND_REST)');
     if (!certPath)
@@ -2241,28 +2497,43 @@ async function runSteps(args, deps) {
     // without one, the credential existed no later than its first recorded use. Two bounds,
     // the larger is taken: the recorded spans after creation (from 1.1.0), and the covered
     // total minus the most that can lie before creation (all time from the first registration
-    // to it). Files written before 1.0.1 record no coverage.
+    // to it). Files written before 1.0.1 record no coverage. Every step must be finite: the
+    // usage reader refuses impossible or reversed times, and if evidence that cannot be placed
+    // on the clock still got this far, the window is invalid rather than silently long.
     const coverage = usage.coverageFor(pubkey);
     let seconds = null;
+    let invalid = false;
     if (coverage) {
+        const start = Date.parse(coverage.firstStart), end = Date.parse(coverage.lastEnd);
         const firstUse = records.length ? records.reduce((first, item) => Math.min(first, Date.parse(item.firstSeen)), Infinity) : null;
         const created = entry ? Date.parse(entry.createdAt) : firstUse;
-        const since = Math.max(Date.parse(coverage.firstStart), created ?? -Infinity);
-        const before = Math.ceil((since - Date.parse(coverage.firstStart)) / 1_000);
-        const lower = Math.max(coverage.coveredSeconds - before, usage.coveredSince(pubkey, since) ?? 0);
-        seconds = Math.max(0, Math.min(lower, Math.floor((Date.parse(coverage.lastEnd) - since) / 1_000)));
-    }
-    const short = seconds === null || seconds < exports.SHORT_OBSERVATION_SECONDS;
+        const since = Math.max(start, created ?? -Infinity);
+        const before = Math.ceil((since - start) / 1_000);
+        const spanned = usage.coveredSince(pubkey, since);
+        const lower = Math.max(coverage.coveredSeconds - before, spanned ?? 0);
+        const bounded = Math.min(lower, Math.floor((end - since) / 1_000));
+        invalid = ![start, end, since, before, lower, bounded, firstUse ?? 0, spanned ?? 0].every(Number.isFinite) || end < start;
+        if (!invalid)
+            seconds = Math.max(0, bounded);
+    }
+    // An invalid window is never accepted: --accept-short-observation accepts a short window,
+    // not one that cannot be computed.
+    const short = invalid || seconds === null || seconds < exports.SHORT_OBSERVATION_SECONDS;
     const observation = { seconds, since: coverage?.firstStart ?? null, until: coverage?.lastEnd ?? null,
-        sessions: coverage?.sessions ?? 0, short, accepted: short && acceptShort };
-    if (short && observed.length)
+        sessions: coverage?.sessions ?? 0, short, accepted: short && acceptShort && !invalid };
+    if (invalid && observed.length)
+        warnings.push({ code: 'observation-invalid', message: 'the observation window cannot be computed '
+                + 'from the coverage record in the usage file (its times are not valid instants in order); no narrowing command is printed, even with '
+                + '--accept-short-observation. Stop watch, move the usage file aside and run watch again' });
+    else if (short && observed.length)
         warnings.push({ code: 'short-observation', message: `usage was observed for ${seconds === null
                 ? 'an unknown time (this usage file has no watch coverage record)' : (0, index_js_3.formatDuration)(seconds)}, less than ${(0, index_js_3.formatDuration)(exports.SHORT_OBSERVATION_SECONDS)}; `
                 + 'methods the app calls rarely (such as payments) may be missing, and a credential narrowed to this list would fail on them. '
                 + (acceptShort ? 'The narrowing command is printed because --accept-short-observation was given'
                     : 'Keep watch running longer, or pass --accept-short-observation to print the narrowing command anyway') });
     const commands = [];
-    if (observed.length && !unmapped.length && !incomplete && !unverified && !beyond.length && (!short || acceptShort)) {
+    if (observed.length && !unmapped.length && !incomplete && !unverified && !beyond.length && !invalid
+        && (!short || acceptShort)) {
         const label = entry?.label ? narrowLabel(entry.label) : 'narrowed';
         const connection = `--lnd-rest ${quote(host)} --tls-cert ${quote((0, online_js_1.recoveryPath)(certPath))} --macaroon ${quote((0, online_js_1.recoveryPath)(ownPath))}` +
             (registryPath ? ` --registry ${quote((0, online_js_1.recoveryPath)(registryPath))}` : '');
@@ -2337,13 +2608,17 @@ const index_js_1 = require("../lnd/index.js");
 const index_js_2 = require("../decode/index.js");
 const protected_path_js_1 = require("../protected-path.js");
 const environment_js_1 = require("../environment.js");
-const index_js_3 = require("../registry/index.js");
-const index_js_4 = require("../output/index.js");
+const index_js_3 = require("../grade/index.js");
+const index_js_4 = require("../registry/index.js");
+const index_js_5 = require("../output/index.js");
 const rotate_js_1 = require("./rotate.js");
 const valueFlags = new Set(['--registry', '--lnd-rest', '--tls-cert', '--macaroon', '--out-dir']);
 const switchFlags = new Set(['--finish', '--dry-run', '--yes', '--allow-admin', '--break-lock', '--json']);
 const methods = [
     ['/lnrpc.Lightning/GetInfo', 'info:read'],
+    // Snapshot drift, as on every online command, checked by respond itself (MW110-09): nested
+    // rotations cannot supply it when nothing is rotated (a dry run, an empty batch).
+    ['/lnrpc.Lightning/ListPermissions', 'info:read'],
     ['/lnrpc.Lightning/ListMacaroonIDs', 'macaroon:read'],
     ['/lnrpc.Lightning/CheckMacaroonPermissions', 'macaroon:read'],
 ];
@@ -2357,7 +2632,7 @@ exports.ROOT_KEY_0_GUIDANCE = [
 exports.OWN_ON_ROOT_KEY_0 = 'macwarden\'s own credential is on root key ID 0: after the change it stops working too. Bake a new own macaroon from the regenerated admin.macaroon before running macwarden again.';
 exports.REVOKED_BUT_PRESENT_GUIDANCE = 'The registry records these root key IDs as revoked, but LND still holds them. Either an earlier revoke did not complete, or someone holding a credential that can bake (macaroon:generate) created credentials on them again. Treat them as live and revoke each: macwarden revoke <id>.';
 exports.BAKING_RISK_GUIDANCE = [
-    'These credentials can bake new macaroons (macaroon:generate). If one leaked, its holder can create credentials on any root key ID, including the replacements respond stages and macwarden\'s own ID. Revoking the old root key IDs does not remove credentials baked that way.',
+    'These credentials can bake new macaroons (macaroon:generate or uri:/lnrpc.Lightning/BakeMacaroon), or hold permissions macwarden could not assess. If one leaked, its holder can create credentials on any root key ID, including the replacements respond stages and macwarden\'s own ID. Revoking the old root key IDs does not remove credentials baked that way.',
     'respond --finish revokes these first; keep the time between staging and finishing short. If a credential that can bake may have leaked, regenerate all root keys instead (see the root key ID 0 guidance): only that invalidates everything an attacker could have baked.',
     'Each PROVEN result covers that credential only: its old root key ID is gone and its replacement is accepted. It does not prove that no other credential exists.',
 ];
@@ -2390,9 +2665,9 @@ function parse(args, env) {
     const finish = flags.has('--finish');
     if (finish && (flags.has('--out-dir') || flags.has('--allow-admin')))
         return '--finish takes neither --out-dir nor --allow-admin';
-    const hostArg = get('--lnd-rest') ?? env.MACWARDEN_LND_REST;
-    const cert = get('--tls-cert') ?? env.MACWARDEN_TLS_CERT;
-    const own = get('--macaroon') ?? env.MACWARDEN_MACAROON;
+    const { host: hostArg, cert, own, problem: mixedSource } = (0, online_js_1.connectionSettings)(get, env);
+    if (mixedSource)
+        return mixedSource;
     if (!hostArg)
         return 'missing --lnd-rest (or MACWARDEN_LND_REST)';
     if (!cert)
@@ -2412,10 +2687,9 @@ function parse(args, env) {
         allowAdmin: flags.has('--allow-admin'), breakLock: flags.has('--break-lock') };
 }
 const byId = (left, right) => { const a = BigInt(left), b = BigInt(right); return a < b ? -1 : a > b ? 1 : 0; };
-/** Active entries that are not themselves a staged replacement of another active entry. */
+/** Active entries that are not themselves a staged replacement of another active entry (as rotate S3; RL-07). */
 function originals(entries) {
-    return entries.filter(entry => entry.status === 'active' && !(entry.replaces !== null
-        && entries.some(old => old.status === 'active' && old.rootKeyId === entry.replaces)));
+    return entries.filter(entry => entry.status === 'active' && !(0, index_js_4.isStagedReplacement)(entries, entry));
 }
 function stagedReplacement(entries, old) {
     return entries.find(entry => entry.status === 'active' && entry.replaces === old.rootKeyId);
@@ -2496,7 +2770,7 @@ async function runSteps(args, deps) {
     try {
         if (request.registry && (0, protected_path_js_1.isProtectedPath)(request.registry))
             return fail(3, 'P3', 'protected registry path');
-        entries = (await (0, index_js_3.openRegistry)(request.registry, { fs: deps.fs, env: deps.env })).entries;
+        entries = (await (0, index_js_4.openRegistry)(request.registry, { fs: deps.fs, env: deps.env })).entries;
     }
     catch {
         return fail(3, 'P3', 'unreadable or invalid registry', warnings);
@@ -2509,6 +2783,8 @@ async function runSteps(args, deps) {
     let ids;
     try {
         node = (0, online_js_1.nodeInfo)(await lnd.getInfo());
+        if ((0, online_js_1.drift)(await lnd.listPermissions()))
+            warnings.push('snapshot-drift');
         ids = await (0, online_js_1.listIds)(lnd);
     }
     catch (error) {
@@ -2523,14 +2799,14 @@ async function runSteps(args, deps) {
     // A staged replacement is believable only if macwarden could have written it; anything else
     // is tampering and is reported instead of trusted (it could hide a credential from the batch).
     // A chain or cycle of links would otherwise make originals() drop live credentials.
-    const tampered = (0, index_js_3.replacementLinkProblems)(mine)[0];
+    const tampered = (0, index_js_4.replacementLinkProblems)(mine)[0];
     if (tampered)
         return fail(3, 'P5', `registry tampering: root key ID ${tampered.rootKeyId} claims to replace ${tampered.replaces}, but ${tampered.problem}; restore the registry from a trusted copy`, warnings);
     // Whether a credential is a canary is decided by its file, not by the editable registry caveat list:
     // a custom caveat the registry does not record would let the batch rotate a canary into an
     // ordinary credential. Refused before any mutation, like a forged replacement link.
     for (const entry of originals(mine)) {
-        if ((0, index_js_3.hasCustomCaveat)(entry))
+        if ((0, index_js_4.hasCustomCaveat)(entry))
             continue;
         const file = await readCredential(entry.outPath, deps);
         if (file && file.facts.fingerprint === entry.fingerprint && file.facts.caveats.some(caveat => caveat.type === 'lnd-custom'))
@@ -2540,7 +2816,12 @@ async function runSteps(args, deps) {
     // Only active entries cover an ID LND holds; a revoked entry for a present ID needs action.
     const active = new Set(mine.filter(entry => entry.status === 'active').map(entry => entry.rootKeyId));
     const revokedIds = new Set(mine.filter(entry => entry.status === 'revoked').map(entry => entry.rootKeyId));
-    const canBake = (entry) => entry.grade === 'ADMIN' || entry.permissions.includes('macaroon:generate');
+    // Baking authority, not the ADMIN grade (MW110-06): macaroon:generate or the BakeMacaroon URI. The
+    // recorded grade is editable, so the permissions are also assessed here; anything unassessed may bake.
+    const canBake = (entry) => {
+        const assessed = (0, index_js_3.grade)(entry.permissions);
+        return (0, index_js_3.canBake)(entry.permissions, entry.grade === 'UNASSESSED' ? 'UNASSESSED' : assessed.grade, assessed.warnings);
+    };
     // revoke resolves a label among this node's active entries; where that is ambiguous, advice names the ID.
     const target = (entry) => entry.label !== null
         && mine.filter(other => other.status === 'active' && other.label === entry.label).length === 1 ? entry.label : entry.rootKeyId;
@@ -2554,7 +2835,7 @@ async function runSteps(args, deps) {
             items.push({ ...base, action: 'manual', status: 'manual', note: entry.rootKeyId === ownId
                     ? 'macwarden\'s own credential: bake a new own macaroon, switch MACWARDEN_MACAROON to it, then revoke this ID'
                     : entry.rootKeyId === '0' ? 'root key ID 0: see the root key ID 0 guidance' : 'no label: revoke it by root key ID, then bake a replacement' });
-        else if ((0, index_js_3.hasCustomCaveat)(entry))
+        else if ((0, index_js_4.hasCustomCaveat)(entry))
             items.push({ ...base, action: 'manual', status: 'manual', note: exports.CUSTOM_CAVEAT_NOTE.replace('<label>', target(entry)) });
         // A replacement an earlier stage allocated but never verified or wrote (an uncertain bake, a failed
         // verification or write, a failed registry update) is unresolved work, not a usable stage. It is
@@ -2642,6 +2923,12 @@ async function runSteps(args, deps) {
         const outDir = (0, node_path_1.resolve)(request.outDir);
         if ((0, protected_path_js_1.isProtectedPath)(outDir))
             return fail(3, 'P6', 'protected output directory', warnings);
+        // Every replacement path is checked before anything is created, so no label can fail
+        // after earlier replacements were written (a label such as CON maps to a Windows device).
+        const outName = (0, protected_path_js_1.outputNameProblem)(outDir)
+            ?? selected.map(item => (0, protected_path_js_1.outputNameProblem)((0, node_path_1.join)(outDir, `${item.label}.macaroon`))).find(problem => problem !== null) ?? null;
+        if (outName)
+            return fail(3, 'P6', `output path refused: ${outName}`, warnings);
         try {
             await deps.fs.mkdir(outDir, { mode: 0o700 });
         }
@@ -2706,7 +2993,7 @@ async function runSteps(args, deps) {
     // P9: independent proof after every finish: the old ID is gone and the replacement is accepted.
     if (request.finish && !interrupted) {
         const after = await (0, online_js_1.listIds)(lnd).then(list => new Set(list.map(id => id.toString())), () => null);
-        const current = await (0, index_js_3.openRegistry)(request.registry, { fs: deps.fs, env: deps.env }).then(view => view.entries).catch(() => mine);
+        const current = await (0, index_js_4.openRegistry)(request.registry, { fs: deps.fs, env: deps.env }).then(view => view.entries).catch(() => mine);
         for (const item of selected.filter(entry => entry.status === 'finished')) {
             const old = current.find(entry => entry.nodePubkey.toLowerCase() === pubkey && entry.rootKeyId === item.rootKeyId);
             const next = current.find(entry => entry.nodePubkey.toLowerCase() === pubkey && entry.rootKeyId === item.replacementRootKeyId);
@@ -2744,7 +3031,7 @@ async function respond(args) {
     return run(args, { fs: nodeFs, env: { ...process.env }, clock: () => new Date(), createAdapter: index_js_1.createLndAdapter,
         stdin: process.stdin,
         prompt: async (question) => {
-            (0, index_js_4.writeRotatePrompt)(question);
+            (0, index_js_5.writeRotatePrompt)(question);
             const input = (0, node_readline_1.createInterface)({ input: process.stdin, terminal: false });
             const signal = (0, cancellation_js_1.cancellationSignal)();
             const close = () => input.close();
@@ -2814,8 +3101,8 @@ const index_js_4 = require("../grade/index.js");
 const protected_path_js_1 = require("../protected-path.js");
 const environment_js_1 = require("../environment.js");
 const process_error_context_js_1 = require("../process-error-context.js");
+const root_key_id_js_1 = require("../root-key-id.js");
 const index_js_5 = require("../output/index.js");
-const maxId = (1n << 64n) - 1n;
 const valueFlags = new Set(['--target-file', '--registry', '--lnd-rest', '--tls-cert', '--macaroon']);
 const switchFlags = new Set(['--unregistered', '--yes', '--break-lock', '--dry-run', '--json']);
 const requiredMethods = [
@@ -2861,11 +3148,9 @@ function parse(args, env) {
     if (target && /^[0-9]+$/.test(target)) {
         if (/^0+$/.test(target))
             return 'root key ID 0 cannot be revoked: it is shared by the default macaroons (SAFE-03)';
-        if (!/^[1-9][0-9]{0,19}$/.test(target))
+        if (!(0, root_key_id_js_1.isRootKeyId)(target))
             return targetRule;
         id = BigInt(target);
-        if (id > maxId)
-            return targetRule;
     }
     else if (!target || !/^[A-Za-z][A-Za-z0-9._-]{0,63}$/.test(target))
         return targetRule;
@@ -2873,10 +3158,10 @@ function parse(args, env) {
         const value = flags.get(name);
         return typeof value === 'string' ? value : undefined;
     };
-    const host = get('--lnd-rest') ?? env.MACWARDEN_LND_REST;
-    const cert = get('--tls-cert') ?? env.MACWARDEN_TLS_CERT;
-    const own = get('--macaroon') ?? env.MACWARDEN_MACAROON;
+    const { host, cert, own, problem: mixedSource } = (0, online_js_1.connectionSettings)(get, env);
     const targetFile = get('--target-file');
+    if (mixedSource)
+        return mixedSource;
     const connection = (0, online_js_1.connectionProblem)(host, cert, own);
     if (connection)
         return connection;
@@ -3007,10 +3292,14 @@ async function runSteps(args, deps, warnings, state) {
     }
     else {
         entry = local.find(row => BigInt(row.rootKeyId) === request.id);
-        if (!entry && entries.some(row => BigInt(row.rootKeyId) === request.id))
-            return fail(2, 'V6', 'root key ID is registered only for another node', warnings);
+        // Root key IDs are per node (small IDs from lncli bakemacaroon --root_key_id exist on every
+        // node), so an entry for another node says nothing about this node's ID: without
+        // --unregistered the operator may have meant that node and is told so; with it, this node's
+        // ID is revoked and recorded under this node's pubkey (RL-04).
         if (!entry && !request.unregistered)
-            return fail(2, 'V6', 'unregistered root key ID requires --unregistered; other tools and other operators share the same LND store, including Lightning Terminal', warnings);
+            return fail(2, 'V6', entries.some(row => BigInt(row.rootKeyId) === request.id)
+                ? 'root key ID is registered only for another node; check --lnd-rest, or pass --unregistered to revoke this node\'s root key ID'
+                : 'unregistered root key ID requires --unregistered; other tools and other operators share the same LND store, including Lightning Terminal', warnings);
     }
     const id = entry ? BigInt(entry.rootKeyId) : request.id;
     const inspection = `root key ID ${id}; run \`${(0, online_js_1.inventoryRecoveryCommand)(request)}\` ` +
@@ -3029,9 +3318,13 @@ async function runSteps(args, deps, warnings, state) {
         catch {
             target = undefined;
         }
-        if (target && target.facts.rootKeyId !== id)
-            return fail(3, 'V6', 'default target file root key ID differs from the registry entry', warnings);
-        if (target && target.facts.fingerprint !== entry.fingerprint)
+        const relation = target && (0, index_js_3.recordedFileRelation)(entry, target.facts);
+        if (relation === 'tampered')
+            return fail(3, 'V6', 'default target file carries the registry entry\'s fingerprint ' +
+                'on another root key ID: the registry entry was edited; restore the registry from a trusted copy', warnings);
+        // Another credential at a reused path, or another macaroon on this root key ID, is not
+        // the target: the revocation is proven by ID only (RL-01).
+        if (relation !== 'match')
             target = undefined;
     }
     let ids;
@@ -3079,8 +3372,8 @@ async function runSteps(args, deps, warnings, state) {
         try {
             const current = await (0, index_js_3.openRegistry)(request.registry, { fs: deps.fs, env: deps.env });
             const resolved = current.find(pubkey, id.toString());
-            if (!(0, node_util_1.isDeepStrictEqual)(resolved, entry)
-                || (!entry && current.entries.some(row => BigInt(row.rootKeyId) === id)))
+            // Node-scoped like V6: an entry for this ID on another node is not this target (RL-04).
+            if (!(0, node_util_1.isDeepStrictEqual)(resolved, entry))
                 return fail(3, 'V10', 'resolved registry entry changed since V6; nothing sent to LND', warnings);
             // Retain the lock owner while preserving unrelated entries from the reread.
             registry.reload(current.entries);
@@ -3128,6 +3421,10 @@ async function runSteps(args, deps, warnings, state) {
                     return fail(7, 'V12', `root key ID still present after deletion; registry unchanged; ${inspection}`, warnings);
             }
             if (proof === 'rejected') {
+                // A signature mismatch alone is no proof (RT-01: an altered copy gets it too). Here it is
+                // corroborating evidence only: both branches above return unless ListMacaroonIDs shows the
+                // ID absent, and proof 'rejected' means V8 saw these exact bytes accepted in this run, so a
+                // mismatch now can only come from LND's state for this ID, not from altered bytes.
                 try {
                     const checked = await lnd.checkMacaroon(target.secret, target.facts.permissions);
                     if (checked.valid !== false || (checked.reason !== 'root-key-missing' && checked.reason !== 'signature-mismatch'))
@@ -3264,6 +3561,7 @@ const index_js_4 = require("../registry/index.js");
 const errors_js_1 = require("../errors.js");
 const index_js_5 = require("../output/index.js");
 const write_out_js_1 = require("./bake/write-out.js");
+const out_errors_js_1 = require("./bake/out-errors.js");
 const allocate_js_1 = require("./bake/allocate.js");
 const valueFlags = new Set(['--out', '--registry', '--lnd-rest', '--tls-cert', '--macaroon']);
 const switchFlags = new Set(['--allow-admin', '--break-lock', '--dry-run', '--json', '--finish', '--yes']);
@@ -3323,9 +3621,9 @@ function parse(args, env) {
         return '--yes is only used with --finish; the stage run asks no confirmation it can skip';
     if (!label)
         return 'give exactly one label';
-    const host = get('--lnd-rest') ?? env.MACWARDEN_LND_REST;
-    const cert = get('--tls-cert') ?? env.MACWARDEN_TLS_CERT;
-    const own = get('--macaroon') ?? env.MACWARDEN_MACAROON;
+    const { host, cert, own, problem: mixedSource } = (0, online_js_1.connectionSettings)(get, env);
+    if (mixedSource)
+        return mixedSource;
     const connection = (0, online_js_1.connectionProblem)(host, cert, own);
     if (connection)
         return connection;
@@ -3353,10 +3651,54 @@ function tampering(entries, old) {
 const CUSTOM_CAVEAT_REFUSAL = 'this credential carries a custom caveat (a canary, or another lnd-custom caveat); a rotation ' +
     'would replace it with an ordinary credential. Revoke it with macwarden revoke <label>, then bake a new canary with ' +
     'macwarden bake --canary and restart macwarden watch';
+const OLD_FILE_TAMPERED = 'old credential file carries the registry entry\'s fingerprint on another root key ID: ' +
+    'the registry entry was edited; restore the registry from a trusted copy';
+/** Active entries with this label that are not a staged replacement (SPEC 6 S3; RL-07). */
 function originals(entries, label) {
-    return entries.filter(entry => entry.label === label && entry.status === 'active'
-        && (entry.replaces === null || entries.some(old => old.status === 'revoked'
-            && old.nodePubkey.toLowerCase() === entry.nodePubkey.toLowerCase() && old.rootKeyId === entry.replaces)));
+    return entries.filter(entry => entry.label === label && entry.status === 'active' && !(0, index_js_4.isStagedReplacement)(entries, entry));
+}
+/**
+ * The original for this label (RL-04). One registry may hold several nodes, and bake allows the
+ * same label on each, so a label active on several nodes is resolved against the node macwarden
+ * is connected to: its own credential and TLS certificate are read and GetInfo (read-only) names
+ * the node. Returns the node's candidates, or a failure at `step`.
+ */
+async function nodeCandidates(candidates, request, deps, step) {
+    if (new Set(candidates.map(entry => entry.nodePubkey.toLowerCase())).size < 2)
+        return candidates;
+    let cert;
+    let own;
+    try {
+        if ((0, protected_path_js_1.isProtectedPath)(request.cert) || (0, protected_path_js_1.isProtectedPath)(await deps.fs.realpath(request.cert)))
+            return fail(4, step, 'unreadable TLS certificate');
+        cert = await (0, online_js_1.readBoundedFile)(request.cert, deps.fs);
+    }
+    catch {
+        return fail(4, step, 'unreadable TLS certificate');
+    }
+    try {
+        own = (await (0, online_js_1.readOnlineCredential)(request.own, { stdin: deps.stdin ?? process.stdin, fs: deps.fs })).secret;
+    }
+    catch {
+        return fail(4, step, 'unreadable own macaroon');
+    }
+    try {
+        (0, index_js_2.decodeMacaroon)(own);
+    }
+    catch {
+        return fail(4, step, 'undecodable own macaroon');
+    }
+    const adapter = deps.lnd ?? deps.createAdapter?.({ restUrl: request.host, tlsCert: cert, macaroon: own });
+    if (!adapter)
+        throw new Error('missing LND adapter');
+    let pubkey;
+    try {
+        pubkey = (0, online_js_1.nodePubkey)(await (0, online_js_1.onlineAdapter)(adapter).getInfo());
+    }
+    catch (error) {
+        return lndFailure(error, step, []);
+    }
+    return candidates.filter(entry => entry.nodePubkey.toLowerCase() === pubkey);
 }
 async function readTarget(path, deps) {
     if ((0, protected_path_js_1.isProtectedPath)(path) || (0, protected_path_js_1.isProtectedPath)(await deps.fs.realpath(path)))
@@ -3396,9 +3738,9 @@ async function finishSteps(request, deps, state) {
     catch {
         return fail(3, 'F3', 'unreadable or invalid registry');
     }
-    const candidates = originals(registry.entries, request.label);
-    if (candidates.length > 1)
-        return fail(2, 'F3', 'label is active on several nodes; use one --registry per node');
+    const candidates = await nodeCandidates(originals(registry.entries, request.label), request, deps, 'F3');
+    if (!Array.isArray(candidates))
+        return candidates;
     const old = candidates[0];
     const forged = old && tampering(registry.entries, old);
     if (forged)
@@ -3504,9 +3846,12 @@ async function finishSteps(request, deps, state) {
             target = await readTarget(old.outPath, deps);
         }
         catch { /* Without a usable old file, ID absence is the proof. */ }
-        if (target && target.facts.rootKeyId !== id)
-            return fail(3, 'F7', 'old credential file root key ID differs from the registry entry', warnings);
-        if (target && target.facts.fingerprint !== old.fingerprint)
+        const relation = target && (0, index_js_4.recordedFileRelation)(old, target.facts);
+        if (relation === 'tampered')
+            return fail(3, 'F7', OLD_FILE_TAMPERED, warnings);
+        // A replacement staged at O's old path, or another macaroon on O's root key ID, is not O's
+        // file: the old credential is then proven revoked by ID only, as in revoke (RL-01).
+        if (relation !== 'match')
             target = undefined;
         if (target && usable(target, deps.clock())) {
             try {
@@ -3635,9 +3980,9 @@ async function runSteps(args, deps, state) {
     catch {
         return fail(3, 'S3', 'unreadable or invalid registry');
     }
-    const candidates = originals(registry.entries, request.label);
-    if (candidates.length > 1)
-        return fail(2, 'S3', 'label is active on several nodes; use one --registry per node');
+    const candidates = await nodeCandidates(originals(registry.entries, request.label), request, deps, 'S3');
+    if (!Array.isArray(candidates))
+        return candidates;
     if (!candidates.length)
         return fail(2, 'S3', 'no eligible active entry for this label');
     const old = candidates[0];
@@ -3663,10 +4008,15 @@ async function runSteps(args, deps, state) {
         }
         catch { /* An unusable old file falls back to the recorded permissions. */ }
     }
+    const relation = oldTarget && (0, index_js_4.recordedFileRelation)(old, oldTarget.facts);
+    if (relation === 'tampered')
+        return fail(3, 'S4', OLD_FILE_TAMPERED);
+    // Another credential at a reused path proves nothing about O: O's recorded permissions then
+    // need the informed approval below, as for a missing file (RL-01).
+    if (relation === 'other-credential')
+        oldTarget = undefined;
     const oldFacts = oldTarget?.facts;
-    if (oldFacts && oldFacts.rootKeyId !== BigInt(old.rootKeyId))
-        return fail(3, 'S4', 'old credential file root key ID differs from the registry entry');
-    if (oldFacts && oldFacts.fingerprint !== old.fingerprint)
+    if (relation === 'same-root-key')
         return fail(3, 'S4', 'old credential fingerprint differs from the registry entry');
     // The registry's caveat list is editable metadata: the credential itself decides whether it is a
     // canary. A custom caveat the registry does not record is tampering, refused before any mutation.
@@ -3699,8 +4049,22 @@ async function runSteps(args, deps, state) {
         return fail(2, 'S5', `unassessed permissions: ${assessment.unassessed.join(', ')}`);
     if (assessment.grade === 'ADMIN' && !request.allowAdmin)
         return fail(2, 'S5', 'ADMIN permissions require --allow-admin');
+    // S11 reuses O's recorded expiry duration: it is checked here, before any lock or LND call,
+    // so a bad value can never leave a baked root key behind (RL-03).
+    const expires = old.caveats.find(caveat => caveat.type === 'time-before' && caveat.requested !== undefined)?.requested;
+    if (expires !== undefined) {
+        try {
+            (0, index_js_2.timeBeforeCondition)(expires, deps.clock);
+        }
+        catch {
+            return fail(3, 'S5', 'registry entry records an invalid expiry duration; restore the registry from a trusted copy');
+        }
+    }
     if ((0, protected_path_js_1.isProtectedPath)(request.out))
         return fail(3, 'S5', 'protected output path');
+    const outName = (0, protected_path_js_1.outputNameProblem)(request.out);
+    if (outName)
+        return fail(3, 'S5', `output path refused: ${outName}`);
     let outPath;
     try {
         outPath = await (0, protected_path_js_1.resolveUnprotectedPath)(request.out, deps.fs);
@@ -3777,8 +4141,8 @@ async function runSteps(args, deps, state) {
                 if (reserved.aclWarning)
                     warnings.push('acl-best-effort');
             }
-            catch {
-                return fail(3, 'S7', 'cannot reserve output file', warnings);
+            catch (error) {
+                return fail(3, 'S7', (0, out_errors_js_1.reserveFailure)(error), warnings);
             }
         }
         const adapter = deps.lnd ?? deps.createAdapter?.({ restUrl: request.host, tlsCert: cert, macaroon: own });
@@ -3835,20 +4199,42 @@ async function runSteps(args, deps, state) {
         const id = rootKeyId.toString();
         state.inspection = `new root key ID ${id}; old credential unchanged; ` +
             `run \`${(0, online_js_1.inventoryRecoveryCommand)(request)}\` to inspect state; recover with ${(0, online_js_1.recoveryCommand)(request, id)}`;
-        const createdAt = deps.clock().toISOString();
+        // Never before O (RL-02): a clock behind O's recorded creation time must not make this
+        // link look like tampering to the finish, respond and inventory checks.
+        const createdAt = new Date(Math.max(deps.clock().getTime(), Date.parse(old.createdAt))).toISOString();
         const entry = { nodePubkey: pubkey, label: request.label, rootKeyId: id,
             permissions: [...permissions], caveats: [], grade: assessment.grade, fingerprint: null,
             outPath: null, createdAt, verified: false, status: 'active', revokedAt: null, revokeEvidence: null,
             replaces: old.rootKeyId, replacedBy: null };
         (0, cancellation_js_1.checkCancellation)();
+        // The pending record may be on disk once save started (a failure after the rename, or a signal
+        // during it), although nothing was sent to LND: it is removed again before reporting, so exit 3
+        // and exit 6 keep meaning "nothing changed"; if the registry on disk still holds it, the exit
+        // is 7 and the message names it with its recovery (RL-08).
+        const unrecord = async (code, step, message) => {
+            try {
+                registry.removePending(pubkey, id);
+                await registry.save();
+                return fail(code, step, message, warnings);
+            }
+            catch { /* Decide from what is on disk. */ }
+            try {
+                if (!(await (0, index_js_4.openRegistry)(request.registry, { fs: deps.fs, env: deps.env })).find(pubkey, id))
+                    return fail(code, step, message, warnings);
+            }
+            catch { /* Unreadable: the record may remain. */ }
+            return fail(7, step, `${message}; nothing sent to LND, but the registry still holds (or may hold) the pending record for root key ${id}` +
+                `; run \`${(0, online_js_1.inventoryRecoveryCommand)(request)}\` and, if it lists root key ${id}, ${(0, online_js_1.recoveryCommand)(request, id)}`, warnings);
+        };
         try {
             registry.add(entry);
             await registry.save();
         }
         catch {
-            return fail(3, 'S10', 'cannot record pending issued ID; nothing sent to LND', warnings);
+            return await unrecord(3, 'S10', 'cannot record pending issued ID; nothing sent to LND');
         }
-        (0, cancellation_js_1.checkCancellation)();
+        if ((0, cancellation_js_1.cancellationSignal)()?.aborted)
+            return await unrecord(6, 'cancelled', 'interrupted');
         let mac;
         state.mutationSent = true;
         (0, process_error_context_js_1.markMutationSent)();
@@ -3907,7 +4293,6 @@ async function runSteps(args, deps, state) {
             return await recover('S11', 'bake response root key ID or permissions differ from the request');
         entry.permissions = [...finalFacts.permissions];
         entry.caveats = finalFacts.caveats.map(({ type, value }) => ({ type, value }));
-        const expires = old.caveats.find(caveat => caveat.type === 'time-before' && caveat.requested !== undefined)?.requested;
         try {
             mac = expires !== undefined ? (0, index_js_2.addFirstPartyCaveat)(mac, (0, index_js_2.timeBeforeCondition)(expires, deps.clock))
                 : (0, index_js_2.encodeMacaroon)(finalFacts);
@@ -4211,7 +4596,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 exports.__esModule = true;
-exports.CUSTOM_CAVEAT_REJECTED = exports.REJECTED_INCONCLUSIVE = exports.OWN_ROOT_KEY_ACCEPTED = exports.CAN_BAKE_ROOT_KEY_0 = exports.CAN_BAKE_ACCEPTED = exports.ROOT_KEY_0_ACCEPTED = void 0;
+exports.CUSTOM_CAVEAT_REJECTED = exports.ROOT_KEY_0_INCONCLUSIVE = exports.OWN_ROOT_KEY_INCONCLUSIVE = exports.SIGNATURE_MISMATCH_ROOT_KEY_0 = exports.SIGNATURE_MISMATCH_HOW_TO_CONCLUDE = exports.SIGNATURE_MISMATCH_INCONCLUSIVE = exports.LOCAL_EXPIRY_UNCONFIRMED = exports.REJECTED_INCONCLUSIVE = exports.OWN_ROOT_KEY_ACCEPTED = exports.CAN_BAKE_ROOT_KEY_0 = exports.CAN_BAKE_ACCEPTED = exports.ROOT_KEY_0_ACCEPTED = void 0;
 exports.run = run;
 exports.verify = verify;
 const nodeFs = __importStar(require("node:fs/promises"));
@@ -4221,8 +4606,9 @@ const environment_js_1 = require("../environment.js");
 const protected_path_js_1 = require("../protected-path.js");
 const index_js_1 = require("../decode/index.js");
 const index_js_2 = require("../input/index.js");
-const index_js_3 = require("../lnd/index.js");
-const index_js_4 = require("../registry/index.js");
+const index_js_3 = require("../grade/index.js");
+const index_js_4 = require("../lnd/index.js");
+const index_js_5 = require("../registry/index.js");
 const inspect_js_1 = require("./inspect.js");
 const valueFlags = ['--registry', '--lnd-rest', '--tls-cert', '--macaroon'];
 // GetInfo (node identity for the registry match), ListPermissions (snapshot drift, as on every
@@ -4240,10 +4626,16 @@ exports.ROOT_KEY_0_ACCEPTED = [
     "That also invalidates every other macaroon on the node at once: every app's credential, macwarden's own and any replacement staged with macwarden respond. So regenerate first, in a maintenance window, then bake a fresh per-app macaroon for each app (macwarden bake) and re-pair it. Run macwarden inventory beforehand to list the apps that will need one; staging replacements before the regeneration would only see them invalidated too.",
     'Procedure: docs/incident-playbook.md and docs/replacing-default-macaroons.md.',
 ];
-exports.CAN_BAKE_ACCEPTED = 'This credential can bake macaroons (macaroon:generate). If it leaked, its holder may have created credentials on other root key IDs, and revoking this one does not remove them. Replace and revoke every registered credential with macwarden respond, list unknown root key IDs with macwarden inventory, and if this credential may have been used, regenerate all root keys (see docs/incident-playbook.md).';
-exports.CAN_BAKE_ROOT_KEY_0 = 'It can also bake macaroons (macaroon:generate): its holder may have created credentials on other root key IDs. The regeneration invalidates those too; afterwards, revoke any root key ID macwarden inventory still shows as unknown that no app of yours uses.';
+exports.CAN_BAKE_ACCEPTED = 'This credential can bake macaroons (macaroon:generate or uri:/lnrpc.Lightning/BakeMacaroon), or macwarden could not assess all of its permissions. If it leaked, its holder may have created credentials on other root key IDs, and revoking this one does not remove them. Replace and revoke every registered credential with macwarden respond, list unknown root key IDs with macwarden inventory, and if this credential may have been used, regenerate all root keys (see docs/incident-playbook.md).';
+exports.CAN_BAKE_ROOT_KEY_0 = 'It can also bake macaroons (macaroon:generate or uri:/lnrpc.Lightning/BakeMacaroon), or may (not all of its permissions could be assessed): its holder may have created credentials on other root key IDs. The regeneration invalidates those too; afterwards, revoke any root key ID macwarden inventory still shows as unknown that no app of yours uses.';
 exports.OWN_ROOT_KEY_ACCEPTED = "This credential shares the root key ID of the credential macwarden is running with, and macwarden revoke refuses its own root key ID. Revoke it with another own credential, or delete that root key ID with lncli deletemacaroonid after switching macwarden to a new session macaroon.";
-exports.REJECTED_INCONCLUSIVE = 'LND rejected this check, but not because the root key ID is gone, the root key was regenerated or the credential expired. A caveat that depends on the caller (an IP lock, or a custom caveat such as a canary\'s) can make LND accept it from another address or while a middleware runs. Treat it as live until its root key ID is revoked.';
+exports.REJECTED_INCONCLUSIVE = 'LND rejected this check, but did not report that the root key ID is gone or that the credential expired. A caveat that depends on the caller (an IP lock, or a custom caveat such as a canary\'s) can make LND accept it from another address or while a middleware runs. Treat it as live until its root key ID is revoked.';
+exports.LOCAL_EXPIRY_UNCONFIRMED = "By this machine's clock a time-before caveat has passed, but LND did not report the expiry: the clocks may differ, or LND refused an earlier caveat first. A local clock is no proof that the credential is dead.";
+exports.SIGNATURE_MISMATCH_INCONCLUSIVE = 'LND reports a signature mismatch, but the root key ID is still listed (or could not be listed). This copy is not the credential LND issued: either the root keys were regenerated, or this copy was altered (a flipped byte, a mangled paste, a decoy) and the original it came from may still be accepted. Treat the original as live until its root key ID is revoked.';
+exports.SIGNATURE_MISMATCH_HOW_TO_CONCLUDE = 'For a conclusive answer, check a copy whose bytes are known to be unaltered: macwarden verify answers conclusively for the exact file it recorded in the registry (same fingerprint). Otherwise compare the fingerprint of this file (above) with one recorded before the incident, such as an inventory --report export or a backup: if they are equal, the bytes are unaltered and the mismatch means the root key was regenerated.';
+exports.SIGNATURE_MISMATCH_ROOT_KEY_0 = 'On root key ID 0 nothing can be revoked on its own: if you have not regenerated every root key (lncli changepassword --new_mac_root_key, which macwarden never runs), assume the original is still live.';
+exports.OWN_ROOT_KEY_INCONCLUSIVE = "This credential is on the root key ID of the credential macwarden is running with, which macwarden revoke refuses. To invalidate it: bake a new session credential on its own root key ID, switch MACWARDEN_MACAROON (or --macaroon) to it, then revoke this root key ID from the new session with macwarden revoke <id> --unregistered (or lncli deletemacaroonid <id>). That also invalidates the old session credential.";
+exports.ROOT_KEY_0_INCONCLUSIVE = 'It is on root key ID 0, which LND cannot revoke on its own: if it may be live, only regenerating every root key invalidates it (lncli changepassword --new_mac_root_key, which macwarden never runs; see docs/incident-playbook.md section 5).';
 exports.CUSTOM_CAVEAT_REJECTED = 'It carries a custom caveat (a canary, or another lnd-custom caveat): LND accepts it only while a middleware for that caveat, such as macwarden watch, is registered.';
 function fail(code, step, message, warnings = []) {
     return { schema: 1, command: 'verify', ok: false, warnings, result: null, error: { code, step, message } };
@@ -4291,9 +4683,9 @@ function parse(args, env) {
     }
     if (inputs.length !== 1)
         return 'expected one input: a credential file, or - for stdin';
-    const host = supplied.get('--lnd-rest') ?? env.MACWARDEN_LND_REST;
-    const cert = supplied.get('--tls-cert') ?? env.MACWARDEN_TLS_CERT;
-    const own = supplied.get('--macaroon') ?? env.MACWARDEN_MACAROON;
+    const { host, cert, own, problem: mixedSource } = (0, online_js_1.connectionSettings)(flag => supplied.get(flag), env);
+    if (mixedSource)
+        return mixedSource;
     const connection = (0, online_js_1.connectionProblem)(host, cert, own);
     if (connection)
         return connection;
@@ -4317,7 +4709,7 @@ function registryMatch(entries, pubkey, facts) {
     const related = pick(local.filter(sameId));
     return related ? { label: related.label, status: related.status, match: 'root-key-id' } : null;
 }
-function guidance(result) {
+function guidance(result, localExpiry) {
     const id = result.rootKeyId;
     if (result.status === 'accepted') {
         const lines = ['LND accepts this credential now: whoever holds a copy can use it against this node.'];
@@ -4338,15 +4730,31 @@ function guidance(result) {
         return lines;
     }
     if (!result.conclusive) {
-        const lines = [exports.REJECTED_INCONCLUSIVE];
+        const lines = [result.rejection === 'signature-mismatch' ? exports.SIGNATURE_MISMATCH_INCONCLUSIVE : exports.REJECTED_INCONCLUSIVE];
+        if (result.rejection === 'signature-mismatch')
+            lines.push(exports.SIGNATURE_MISMATCH_HOW_TO_CONCLUDE);
+        if (result.rejection === 'signature-mismatch' && id === '0')
+            lines.push(exports.SIGNATURE_MISMATCH_ROOT_KEY_0);
         if (result.caveats.some(caveat => caveat.type === 'lnd-custom'))
             lines.push(exports.CUSTOM_CAVEAT_REJECTED);
-        if (id !== '0')
+        if (localExpiry)
+            lines.push(exports.LOCAL_EXPIRY_UNCONFIRMED);
+        // Never a revoke command macwarden would refuse (RL-06): not for root key ID 0 (SAFE-03),
+        // not for macwarden's own root key ID (revoke V4).
+        if (id === '0') {
+            if (result.rejection !== 'signature-mismatch')
+                lines.push(exports.ROOT_KEY_0_INCONCLUSIVE);
+        }
+        else if (result.ownCredential)
+            lines.push(exports.OWN_ROOT_KEY_INCONCLUSIVE);
+        else
             lines.push(`To make sure: macwarden revoke ${id}${result.registry === null ? ' --unregistered' : ''}.`);
         return lines;
     }
     const why = result.rejection === 'root-key-missing' ? 'its root key ID no longer exists'
-        : result.rejection === 'signature-mismatch' ? 'its root key was regenerated'
+        : result.rejection === 'signature-mismatch' ? (result.rootKeyListed === false
+            ? 'its signature does not match and its root key ID is no longer listed'
+            : `its root key was regenerated: these are the exact bytes macwarden recorded for root key ID ${id}, and LND no longer accepts their signature`)
             : result.rejection === 'expired' ? 'a time-before caveat has passed' : 'its root key ID is no longer listed';
     const lines = [`LND rejects this credential now: ${why}. It can no longer be used against this node.`];
     if (result.rejection === 'expired' && result.rootKeyListed !== false && id !== '0')
@@ -4420,7 +4828,7 @@ async function runSteps(args, deps, warnings) {
     try {
         if (request.registry && (0, protected_path_js_1.isProtectedPath)(request.registry))
             return fail(3, 'C5', 'protected registry path', warnings);
-        entries = (await (0, index_js_4.openRegistry)(request.registry, { fs: deps.fs, env: deps.env })).entries;
+        entries = (await (0, index_js_5.openRegistry)(request.registry, { fs: deps.fs, env: deps.env })).entries;
     }
     catch {
         return fail(3, 'C5', 'unreadable or invalid registry', warnings);
@@ -4461,22 +4869,38 @@ async function runSteps(args, deps, warnings) {
     catch (error) {
         return lndFailure(error, 'C7', warnings);
     }
-    const expired = offline.caveats.some(caveat => caveat.type === 'time-before' && caveat.expired === true);
+    // Only node-side evidence makes a rejection conclusive: LND's own expiry error naming one of
+    // this credential's time-before caveats (judged by the node's clock), or a missing root key ID
+    // (reported by LND or absent from ListMacaroonIDs). The local clock never does (MW110-02): it can be skewed, and an earlier
+    // caveat that depends on the caller (IP lock, custom caveat) may be what LND refused.
+    const nodeExpired = !checked.valid && checked.reason === 'expired'
+        && facts.caveats.some(caveat => caveat.type === 'time-before' && caveat.value === checked.caveat);
     const rejection = checked.valid ? null
-        : checked.reason === 'other' && expired ? 'expired' : checked.reason;
-    // A rejection holds everywhere when the root key is gone or regenerated, or the credential
-    // expired; any other rejection may depend on the caller (IP lock, custom caveat).
-    const conclusive = checked.valid || rejection !== 'other' || rootKeyListed === false;
+        : checked.reason === 'expired' ? (nodeExpired ? 'expired' : 'other') : checked.reason;
+    // A rejection holds everywhere when the root key ID is gone or the credential expired; any other
+    // rejection may depend on the caller (IP lock, custom caveat) or on the copy itself.
+    // A signature mismatch is what LND answers both after a root key regeneration and for any
+    // altered copy (RT-01): a regeneration keeps every root key ID listed, so a mismatch alone never
+    // proves the original dead. It is conclusive once the root key ID is no longer listed, or when
+    // these are the exact bytes macwarden recorded for this root key ID on this node (registry
+    // fingerprint match): known-genuine bytes can only mismatch because the root key changed.
+    // The own credential is no such evidence: it authenticating proves only that its own bytes are
+    // valid, not whether the target's differ by alteration or by a regeneration since it was baked.
+    const registry = registryMatch(entries, info.pubkey, facts);
+    const recordedBytes = registry?.match === 'fingerprint';
+    const conclusive = checked.valid || rejection === 'root-key-missing' || rejection === 'expired'
+        || rootKeyListed === false || (rejection === 'signature-mismatch' && recordedBytes);
+    const localExpiry = offline.caveats.some(caveat => caveat.type === 'time-before' && caveat.expired === true);
     const partial = {
         ...offline,
         node: { pubkey: info.pubkey, alias: info.alias, network: info.network },
         status: checked.valid ? 'accepted' : 'rejected',
         rejection, conclusive, rootKeyListed,
         ownCredential: facts.rootKeyId === ownFacts.rootKeyId,
-        canBake: offline.grade === 'ADMIN' || facts.permissions.includes('macaroon:generate'),
-        registry: registryMatch(entries, info.pubkey, facts),
+        canBake: (0, index_js_3.canBake)(facts.permissions, offline.grade, offline.warnings),
+        registry,
     };
-    const result = { ...partial, guidance: guidance(partial) };
+    const result = { ...partial, guidance: guidance(partial, localExpiry) };
     // Exit 1 is a finding, as with scan --fail-on: the credential is live, or may be.
     return { schema: 1, command: 'verify', ok: true, warnings, result, error: null,
         ...(result.status === 'accepted' || !result.conclusive ? { exitCode: 1 } : {}) };
@@ -4493,7 +4917,7 @@ async function run(args, deps) {
     }
 }
 async function verify(args) {
-    return run(args, { createAdapter: index_js_3.createLndAdapter, fs: nodeFs, env: { ...process.env },
+    return run(args, { createAdapter: index_js_4.createLndAdapter, fs: nodeFs, env: { ...process.env },
         clock: () => new Date(), stdin: process.stdin });
 }
 
@@ -4557,6 +4981,7 @@ const protected_path_js_1 = require("../protected-path.js");
 const bounded_file_js_1 = require("../bounded-file.js");
 const index_js_3 = require("../registry/index.js");
 const process_domain_js_1 = require("../registry/process-domain.js");
+const root_key_id_js_1 = require("../root-key-id.js");
 const index_js_4 = require("../output/index.js");
 const canary_js_1 = require("../watch/canary.js");
 const usage_js_1 = require("../watch/usage.js");
@@ -4632,9 +5057,9 @@ function parse(args, env) {
             return 'unknown flag';
     }
     const get = (flag) => { const value = flags.get(flag); return typeof value === 'string' ? value : undefined; };
-    const host = get('--lnd-rest') ?? env.MACWARDEN_LND_REST;
-    const cert = get('--tls-cert') ?? env.MACWARDEN_TLS_CERT;
-    const own = get('--macaroon') ?? env.MACWARDEN_MACAROON;
+    const { host, cert, own, grpc: grpcValue, problem: mixedSource } = (0, online_js_1.connectionSettings)(get, env, true);
+    if (mixedSource)
+        return mixedSource;
     if (!host)
         return 'missing --lnd-rest (or MACWARDEN_LND_REST)';
     if (!cert)
@@ -4646,9 +5071,8 @@ function parse(args, env) {
     const rest = hostPort(host);
     if (!rest)
         return 'invalid LND REST endpoint';
-    const grpcValue = get('--lnd-grpc') ?? env.MACWARDEN_LND_GRPC;
     const grpcSource = get('--lnd-grpc') !== undefined ? '--lnd-grpc'
-        : env.MACWARDEN_LND_GRPC !== undefined ? 'MACWARDEN_LND_GRPC' : 'the default port 10009 on the --lnd-rest host';
+        : grpcValue !== undefined ? 'MACWARDEN_LND_GRPC' : 'the default port 10009 on the --lnd-rest host';
     const grpc = grpcValue === undefined ? { host: rest.host, port: 10009 } : hostPort(grpcValue);
     if (!grpc)
         return 'invalid LND gRPC endpoint';
@@ -4753,7 +5177,7 @@ async function takeOverStaleLock(path, stale, pid, deps) {
     }
     let moved = '';
     try {
-        moved = await deps.fs.readFile(quarantine, 'utf8');
+        moved = await (0, bounded_file_js_1.readPlainFile)(quarantine, deps.fs, bounded_file_js_1.LOCK_FILE_LIMIT);
     }
     catch { /* treated as not ours */ }
     if (moved === stale) {
@@ -4797,7 +5221,7 @@ async function acquireLock(path, deps) {
                 try {
                     const current = await deps.fs.lstat(path, { bigint: true });
                     if (current.dev === identity.dev && current.ino === identity.ino
-                        && await deps.fs.readFile(path, 'utf8') === body)
+                        && await (0, bounded_file_js_1.readPlainFile)(path, deps.fs, bounded_file_js_1.LOCK_FILE_LIMIT) === body)
                         await deps.fs.unlink(path);
                 }
                 catch { /* already gone */ }
@@ -4809,9 +5233,9 @@ async function acquireLock(path, deps) {
             let owner = {};
             let stale;
             try {
-                // The owner record is read only as a plain file: never through a symlink (SAFE-02).
-                await (0, bounded_file_js_1.assertPlainFile)(path, deps.fs, bounded_file_js_1.LOCK_FILE_LIMIT);
-                stale = await deps.fs.readFile(path, 'utf8');
+                // The owner record is read only as a plain file: never through a symlink (SAFE-02),
+                // through one descriptor bound to the checked file and at most LOCK_FILE_LIMIT + 1 bytes.
+                stale = await (0, bounded_file_js_1.readPlainFile)(path, deps.fs, bounded_file_js_1.LOCK_FILE_LIMIT);
                 owner = JSON.parse(stale);
             }
             catch {
@@ -4848,7 +5272,6 @@ async function alertCommandProblem(command, deps) {
     return null;
 }
 const CREDENTIAL_ID = /^id:[0-9a-f]{16}$/;
-const ROOT_KEY_ID = /^(?:0|[1-9][0-9]{0,19})$/;
 function labels(entries, pubkey) {
     const byRootKey = new Map();
     for (const entry of entries) {
@@ -5114,7 +5537,7 @@ async function runSteps(args, deps) {
             }
             requestKeys.delete(id);
             counters.errors += 1;
-            if (CREDENTIAL_ID.test(key.credential) && ROOT_KEY_ID.test(key.rootKeyId))
+            if (CREDENTIAL_ID.test(key.credential) && (0, root_key_id_js_1.isRootKeyId)(key.rootKeyId))
                 usage.record(pubkey, key.credential, key.rootKeyId, key.method, at, true);
             emit({ event: 'error', time: at.toISOString(), method: key.method, rootKeyId: key.rootKeyId,
                 credential: key.credential, label: labelFor(key.rootKeyId) });
@@ -5141,7 +5564,7 @@ async function runSteps(args, deps) {
         counters.calls += 1;
         if (counters.credentials.size < CREDENTIAL_COUNT_LIMIT)
             counters.credentials.add(credential);
-        if (CREDENTIAL_ID.test(credential) && ROOT_KEY_ID.test(rootKeyId))
+        if (CREDENTIAL_ID.test(credential) && (0, root_key_id_js_1.isRootKeyId)(rootKeyId))
             usage.record(pubkey, credential, rootKeyId, call.method, at);
         emit({ event: 'call', time: at.toISOString(), method: call.method, rootKeyId, credential,
             label: labelFor(rootKeyId) });
@@ -5530,6 +5953,75 @@ function literalHexSpans(text) {
     hexSpans(value, starts, ends, found);
     return found;
 }
+// Raw bytes rendered as UTF-8 (Buffer#toString('utf8'), TextDecoder, Go's string printing)
+// keep every byte below 0x80 and every valid sequence, but replace each ill-formed sequence
+// of one to three bytes with U+FFFD. Lengths and offsets of a binary credential are lost, so
+// it is recognised by the framing that survives instead. Every such rendering of a credential
+// the structural decoder accepts starts with U+0002 and a header packet kind (1 or 2; a
+// non-minimal varint kind renders as U+FFFD... U+0000), and holds, after an end-of-section
+// U+0000, its signature packet header (kind 6, length 32, each minimal or as U+FFFD... U+0000)
+// followed by 32 bytes. The span runs from the first such start to the end of the last
+// signature that can follow it, counting each U+FFFD as at least one byte: never shorter than
+// the credential's rendering. Bytes 0x80 and above never render as ASCII, so this is sound;
+// it can only redact more, and only text that already holds these control characters.
+const NON_ASCII = /[\u0080-￿]/;
+const SIGNATURE_BYTES = 32;
+const MAX_VARINT = 10;
+/** End (exclusive) of a small varint at `at` rendered as UTF-8, or -1: `minimal` or U+FFFD{1,9} U+0000. */
+function renderedVarint(text, at, minimal) {
+    if (text[at] === minimal)
+        return at + 1;
+    let cursor = at;
+    while (cursor < text.length && cursor - at < MAX_VARINT - 1 && text[cursor] === '�')
+        cursor++;
+    return cursor > at && text[cursor] === '\u0000' ? cursor + 1 : -1;
+}
+/** Fewest and most UTF-8 bytes the code unit at `at` can stand for in a rendering. */
+function renderedBytes(text, at) {
+    const unit = text.charCodeAt(at);
+    if (unit < 0x80)
+        return [1, 1];
+    if (unit < 0x800)
+        return [2, 2];
+    if (unit === 0xfffd)
+        return [1, 3];
+    if (unit >= 0xdc00 && unit <= 0xdfff)
+        return [0, 0];
+    return unit >= 0xd800 && unit <= 0xdbff ? [4, 4] : [3, 3];
+}
+function utf8RenderingSpans(text, starts, ends, found) {
+    let first = -1;
+    for (let at = text.indexOf('\u0002'); at >= 0 && at + 1 < text.length; at = text.indexOf('\u0002', at + 1)) {
+        if (text[at + 1] === '\u0001' || renderedVarint(text, at + 1, '\u0002') !== -1) {
+            first = at;
+            break;
+        }
+    }
+    if (first < 0)
+        return;
+    // The last signature header after the start whose 32 bytes can still follow it.
+    for (let at = text.length - 1; at > first; at--) {
+        if (text[at] !== '\u0000')
+            continue;
+        const kind = renderedVarint(text, at + 1, '\u0006');
+        const body = kind < 0 ? -1 : renderedVarint(text, kind, ' ');
+        if (body < 0)
+            continue;
+        let fewest = 0, most = 0, end = body;
+        while (end < text.length && fewest < SIGNATURE_BYTES) {
+            const [low, high] = renderedBytes(text, end++);
+            fewest += low;
+            most += high;
+        }
+        if (most < SIGNATURE_BYTES)
+            continue;
+        // Keep a surrogate pair whole.
+        if (end < text.length && renderedBytes(text, end)[1] === 0)
+            end++;
+        found.push([starts[first], ends[end - 1]]);
+        return;
+    }
+}
 function spans(text, source, backslashPairs = true) {
     const { value, starts, ends } = normalized(text, true, source, true, backslashPairs);
     const found = [];
@@ -5580,6 +6072,9 @@ function spans(text, source, backslashPairs = true) {
             found.push([raw.starts[pos], raw.ends[pos + length - 1]]);
             pos += length - 1;
         }
+        // A UTF-8 rendering differs from the latin1 one only when a character is not ASCII.
+        if (NON_ASCII.test(raw.value))
+            utf8RenderingSpans(raw.value, raw.starts, raw.ends, found);
         // UTF-16 byte strings can carry raw credentials with zero-byte padding.
         for (const phase of [0, 1])
             for (const order of [0, 1]) {
@@ -6522,9 +7017,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 exports.__esModule = true;
+exports.BAKE_MACAROON_URI = void 0;
 exports.grade = grade;
 exports.gradeFacts = gradeFacts;
 exports.describe = describe;
+exports.canBake = canBake;
 const lnd_permissions_json_1 = __importDefault(require("./lnd-permissions.json"));
 const classes = ['READ', 'RECEIVE', 'OPERATE', 'SPEND', 'ADMIN'];
 const knownEntities = new Set([
@@ -6616,6 +7113,19 @@ function describe(facts) {
         warnings.add('root-key-0');
     return byteSort(warnings);
 }
+/** The exact URI permission LND accepts for BakeMacaroon, besides macaroon:generate. */
+exports.BAKE_MACAROON_URI = 'uri:/lnrpc.Lightning/BakeMacaroon';
+const INCOMPLETE = ['identifier-exceeds-bounds', 'caveats-exceed-bounds', 'unassessed-permission', 'unassessed-uri'];
+/**
+ * Whether a credential can, or may, bake macaroons (MW110-06). Baking needs macaroon:generate or
+ * the BakeMacaroon URI; the ADMIN grade alone does not imply it (macaroon:write is ADMIN, and
+ * LND refuses BakeMacaroon with it). A decode or assessment that is incomplete (truncated
+ * identifier or caveats, unassessed permissions, grade UNASSESSED) fails closed: it may bake.
+ */
+function canBake(permissions, assessedGrade, warnings = []) {
+    return permissions.includes('macaroon:generate') || permissions.includes(exports.BAKE_MACAROON_URI)
+        || assessedGrade === 'UNASSESSED' || warnings.some(warning => INCOMPLETE.includes(warning));
+}
 
 },
 "grouped-runs.js": (module, exports, require) => {
@@ -6892,7 +7402,11 @@ exports.__esModule = true;
 exports.parseLndconnect = parseLndconnect;
 // Parse the raw query value so URLSearchParams cannot turn a literal plus into
 // a space or silently repair malformed percent escapes.
-function parseLndconnect(value) {
+/**
+ * `standardBase64`: also accept the macaroon in the standard base64 alphabet (`+`, `/`), as
+ * some generators write it. Scan detection uses it; credential input keeps base64url only.
+ */
+function parseLndconnect(value, { standardBase64 = false } = {}) {
     try {
         const fragmentStart = value.indexOf('#');
         const queryStart = value.indexOf('?');
@@ -6908,7 +7422,9 @@ function parseLndconnect(value) {
         const uri = new URL(value);
         if (uri.protocol.toLowerCase() !== 'lndconnect:' || !uri.hostname)
             return null;
-        const form = decodeURIComponent(encoded);
+        let form = decodeURIComponent(encoded);
+        if (standardBase64 && /^[A-Za-z0-9+/]+={0,2}$/.test(form))
+            form = form.replace(/\+/g, '-').replace(/\//g, '_');
         if (!/^[A-Za-z0-9_-]+={0,2}$/.test(form) || form.length % 4 === 1)
             return null;
         const bare = form.replace(/=+$/, '');
@@ -6923,6 +7439,36 @@ function parseLndconnect(value) {
     }
 }
 
+},
+"instant.js": (module, exports, require) => {
+"use strict";
+// UTC instants as macwarden writes them (Date.prototype.toISOString, or the same without the
+// fraction), read back from the registry and the watch usage file.
+exports.__esModule = true;
+exports.isInstant = isInstant;
+const SHAPE = /^(\d{4})-(\d\d)-(\d\d)T(\d\d):(\d\d):(\d\d)(?:\.\d+)?Z$/;
+function daysIn(year, month) {
+    if (month === 2)
+        return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28;
+    return [4, 6, 9, 11].includes(month) ? 30 : 31;
+}
+/**
+ * True for `YYYY-MM-DDTHH:MM:SS[.fraction]Z` naming a real instant: a month 1 to 12, a day that
+ * exists in that month, hours 0 to 23, minutes and seconds 0 to 59. The shape alone is not
+ * enough: Date.parse gives NaN for month 99 and silently rolls 30 February or 24:00 into
+ * another day, and either would corrupt time arithmetic on the value.
+ */
+function isInstant(value) {
+    if (typeof value !== 'string')
+        return false;
+    const match = SHAPE.exec(value);
+    if (!match)
+        return false;
+    const [year, month, day, hour, minute, second] = match.slice(1).map(Number);
+    return month >= 1 && month <= 12 && day >= 1 && day <= daysIn(year, month)
+        && hour <= 23 && minute <= 59 && second <= 59 && Number.isFinite(Date.parse(value));
+}
+
 },
 "lnd/grpc.js": (module, exports, require) => {
 "use strict";
@@ -7250,6 +7796,13 @@ const MAX_RESPONSE = 1_048_576;
 const TIMEOUT_MS = 10_000;
 const ROOT_MISSING = /root key with id [0-9]+ doesn't exist/i;
 const SIGNATURE_MISMATCH = /signature mismatch/i;
+// LND v0.21.4 CheckMacaroonPermissions (rpcserver.go) returns gRPC InvalidArgument with err.Error() of
+// macaroons/service.go CheckMacAuth. Its bakery (macaroon-bakery v2.0.1) checks every first-party caveat
+// in order and reports the first that fails as `caveat %q not satisfied: <reason>` (checkers.go), and
+// for an expired time-before the reason is `macaroon has expired` (checkers/time.go), judged by the
+// node's clock. Only that exact whole message is expiry evidence; the caveat value is returned so the
+// caller can match it against the credential's own decoded caveats.
+const NODE_EXPIRED = /^caveat "time-before ([^"\\]*)" not satisfied: macaroon has expired$/;
 const MAX_ROOT_KEY_ID = (1n << 64n) - 1n;
 function ownAuthenticationFailure(response) {
     if (response.status === 401 || response.status === 403)
@@ -7517,6 +8070,9 @@ function createLndAdapter(config) {
                     throw new errors_js_1.LndError(5, stage, 'invalid LND response');
                 const missing = response.status === 400 && ROOT_MISSING.test(message);
                 const mismatch = response.status === 400 && SIGNATURE_MISMATCH.test(message);
+                const expired = NODE_EXPIRED.exec(message);
+                if (expired && !missing && !mismatch)
+                    return { valid: false, reason: 'expired', caveat: expired[1], message: 'LND rejected macaroon' };
                 const reason = missing && !mismatch ? 'root-key-missing'
                     : mismatch && !missing
                         ? 'signature-mismatch' : 'other';
@@ -7909,6 +8465,7 @@ exports.readBoundedFile = exports.LABEL_RULE = void 0;
 exports.endpoint = endpoint;
 exports.credentialText = credentialText;
 exports.connectionProblem = connectionProblem;
+exports.connectionSettings = connectionSettings;
 exports.flagProblem = flagProblem;
 exports.nodeInfo = nodeInfo;
 exports.nodePubkey = nodePubkey;
@@ -7966,6 +8523,37 @@ function connectionProblem(host, cert, own) {
         return '--lnd-rest (or MACWARDEN_LND_REST) must be host:port, without scheme, path, query or user information';
     return null;
 }
+const CONNECTION = [
+    { key: 'host', flag: '--lnd-rest', variable: 'MACWARDEN_LND_REST' },
+    { key: 'cert', flag: '--tls-cert', variable: 'MACWARDEN_TLS_CERT' },
+    { key: 'own', flag: '--macaroon', variable: 'MACWARDEN_MACAROON' },
+    { key: 'grpc', flag: '--lnd-grpc', variable: 'MACWARDEN_LND_GRPC' },
+];
+/**
+ * The node address, its TLS certificate and the credential macwarden presents come from one
+ * source: when any of them is given as a flag, all of them must be flags, so a credential
+ * exported for one node is never sent to a node named on the command line (and the reverse).
+ * With no connection flag, all come from the environment. `grpc` (watch) joins the set when
+ * `withGrpc` is true. A mixed invocation sets `problem`, naming the variables, never values.
+ */
+function connectionSettings(flag, env, withGrpc = false) {
+    const items = CONNECTION.filter(item => withGrpc || item.key !== 'grpc');
+    const flagged = items.filter(item => flag(item.flag) !== undefined);
+    const settings = { problem: null };
+    if (!flagged.length) {
+        for (const item of items)
+            settings[item.key] = env[item.variable];
+        return settings;
+    }
+    for (const item of items)
+        settings[item.key] = flag(item.flag);
+    const mixed = items.filter(item => flag(item.flag) === undefined && env[item.variable] !== undefined && env[item.variable] !== '');
+    if (mixed.length)
+        settings.problem = `${flagged.map(item => item.flag).join(', ')} given on the command line, so ` +
+            `${mixed.map(item => item.variable).join(', ')} from the environment is not used: connection settings come all from flags ` +
+            `or all from the environment; give ${mixed.map(item => item.flag).join(', ')} too, or unset ${mixed.map(item => item.variable).join(', ')}`;
+    return settings;
+}
 /** Wording for a value flag given twice or without a value. */
 function flagProblem(flag, kind) {
     return kind === 'repeated' ? `${flag} was given more than once` : `${flag} needs a value`;
@@ -8042,7 +8630,7 @@ function readOnlineCredential(path, io) {
 }
 function onlineWarnings(result) {
     const messages = {
-        'acl-best-effort': "the file inherits the folder's permissions",
+        'acl-best-effort': "the volume stores no Windows permissions (FAT or exFAT): anyone with access to the volume can read the file",
         'unsafe-arg': 'literal credentials can appear in shell history and process listings',
         'own-root-key-0': 'own credential uses root key ID 0',
         'snapshot-drift': 'LND permissions differ from the bundled snapshot',
@@ -8080,6 +8668,8 @@ const patterns_js_1 = require("../scan/patterns.js");
 const nwc_match_js_1 = require("../scan/nwc-match.js");
 const credential_recognition_js_1 = require("../credential-recognition.js");
 const redact_js_1 = require("../scan/redact.js");
+const online_js_1 = require("../online.js");
+const node_path_1 = require("node:path");
 function rotatePlanResult(plan, next, warnings, repaired) {
     return { schema: 1, command: 'rotate', ok: true, warnings, result: plan, error: null, display: { finish: { next, repaired } } };
 }
@@ -8168,16 +8758,22 @@ function jsonRedactor() {
         return safe;
     };
 }
+// eslint-disable-next-line no-control-regex, no-misleading-character-class
+const UNSAFE_TEXT = /[\x00-\x1f\x7f-\xa0\u034f\u115f\u1160\u1680\u17b4\u17b5\u180b-\u180f\u2000-\u200f\u2028-\u202f\u205f-\u206f\u3000\u3164\ufe00-\ufe0f\uffa0\u{e0000}-\u{e0fff}\p{Cf}]/gu;
 function safeText(value) {
     // Control characters, the Unicode bidirectional controls that can make a terminal show
     // text in a different order than it is stored (Trojan Source), and Unicode whitespace
     // other than the plain space are escaped. A CI runner trims Unicode whitespace before it
     // looks for a '::' workflow command, so none may reach a line start unescaped. The
     // legacy '##[' command marker is recognised anywhere in a line, so it is escaped too.
-    // eslint-disable-next-line no-control-regex
-    return redact(value).replace(/[\x00-\x1f\x7f-\xa0\u061c\u1680\u2000-\u200f\u2028-\u202f\u205f\u2066-\u2069\u3000\ufeff]/g, character => character.charCodeAt(0) < 0x100 ? `\\x${character.charCodeAt(0).toString(16).padStart(2, '0')}`
-        : `\\u${character.charCodeAt(0).toString(16).padStart(4, '0')}`)
-        .replace(/##\[/g, '##\\x5b');
+    // Invisible characters are escaped as well, so a name cannot look like a different file:
+    // every format character (Unicode Cf: soft hyphen, zero-width characters, word joiner,
+    // tags), the Hangul fillers, the combining grapheme joiner and the variation selectors.
+    return redact(value).replace(UNSAFE_TEXT, character => {
+        const code = character.codePointAt(0);
+        return code < 0x100 ? `\\x${code.toString(16).padStart(2, '0')}`
+            : code <= 0xffff ? `\\u${code.toString(16).padStart(4, '0')}` : `\\u{${code.toString(16)}}`;
+    }).replace(/##\[/g, '##\\x5b');
 }
 /**
  * Text output is often read by CI runners. No line may start, after spaces, with '::'
@@ -8194,7 +8790,7 @@ const warningMessages = {
     'unsafe-arg': 'literal credentials can appear in shell history and process listings',
     'own-root-key-0': 'own credential uses root key ID 0',
     'snapshot-drift': 'LND method permissions differ from the bundled snapshot',
-    'acl-best-effort': "the file inherits the folder's permissions",
+    'acl-best-effort': "the volume stores no Windows permissions (FAT or exFAT): anyone with access to the volume can read the file",
     'usage-unreadable': 'the watch usage file could not be read; last-used data is omitted',
     'usage-write-failed': 'the watch usage file could not be written; usage since the last save is lost',
     'canary-requires-watch': 'LND accepts this canary only while macwarden watch runs; a running watch picks it up within 60 seconds (or at its next reconnect), then denies and alerts on every use its permissions allow',
@@ -8214,7 +8810,12 @@ function* scanTextLines(result) {
         // relative path is printed as ./path; it names the same file.
         const path = /^[\s\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]*:/.test(finding.path)
             ? `./${finding.path}` : finding.path;
-        const also = finding.alsoAt ? ` (same content also added at ${finding.alsoAt.count} other path${finding.alsoAt.count === 1 ? '' : 's'})` : '';
+        const others = finding.alsoAt ? `${finding.alsoAt.count} other path${finding.alsoAt.count === 1 ? '' : 's'}` : '';
+        // A work-tree finding's alsoAt lists the file's other hard-link names: they are named, since
+        // removing the credential from one name leaves it readable under the others.
+        const also = !finding.alsoAt ? '' : finding.commit !== undefined ? ` (same content also added at ${others})`
+            : ` (same file also at ${others}: ${finding.alsoAt.paths.map(safeText).join(', ')}`
+                + `${finding.alsoAt.count > finding.alsoAt.paths.length ? ', ...' : ''})`;
         const location = `${finding.commit === undefined ? '' : `${finding.commit.slice(0, 7)}:`}${path}` +
             (finding.line === null ? '' : `:${finding.line}:${finding.column}`);
         const counted = finding.kind === 'nwc' ? ' (counted as SPEND)'
@@ -8352,6 +8953,39 @@ function alignedRows(table) {
     return table.map(cells => cells.map((cell, column) => column === cells.length - 1 ? cell
         : cell + ' '.repeat(widths[column] - [...cell].length)).join('  ').trimEnd());
 }
+/**
+ * The argument `revoke` resolves to this row's credential (RL-05): its label only when that label
+ * names exactly one active entry on the node (as revoke V6 requires), otherwise its root key ID.
+ * Null when revoke refuses the row (root key ID 0, macwarden's own credential).
+ */
+function revokeTarget(rows, row) {
+    if (row.rootKeyId === '0' || row.flags.includes('default-root-key') || row.flags.includes('own-credential'))
+        return null;
+    const label = row.entry?.label ?? null;
+    return label !== null && rows.filter(other => other.entry?.status === 'active' && other.entry.label === label).length === 1
+        ? label : row.rootKeyId;
+}
+/**
+ * The rotate command for this row, or null when rotate would refuse it (RL-05): no label, root
+ * key ID 0, macwarden's own credential, a staged replacement or an original that already has one,
+ * an invalid link, a custom caveat (a canary) or unassessed permissions. `--out` defaults to
+ * `<label>-<YYYY-MM-DD>.macaroon` next to the recorded file (or in the current directory when no
+ * file is recorded); ADMIN adds `--allow-admin`, which rotate requires.
+ */
+function rotateCommand(row, now) {
+    const entry = row.entry;
+    if (!entry || entry.status !== 'active' || entry.label === null || row.rootKeyId === '0')
+        return null;
+    if (['own-credential', 'default-root-key', 'replacement', 'pending-replacement', 'invalid-replacement']
+        .some(flag => row.flags.includes(flag)))
+        return null;
+    if (entry.caveats.some(caveat => caveat.type === 'lnd-custom') || entry.grade === 'UNASSESSED')
+        return null;
+    const name = `${entry.label}-${new Date(now).toISOString().slice(0, 10)}.macaroon`;
+    const out = entry.outPath ? (0, node_path_1.join)((0, node_path_1.dirname)(entry.outPath), name) : name;
+    return ['macwarden', 'rotate', entry.label, '--out', out, ...(entry.grade === 'ADMIN' ? ['--allow-admin'] : [])]
+        .map(value => (0, online_js_1.shellQuote)(value)).join(' ');
+}
 function inventoryText(result, now) {
     const { node, rootKeys: rows } = result;
     const lines = [`node ${safeText(node.pubkey)} (${safeText(node.alias)}) ${safeText(node.network)}`];
@@ -8387,13 +9021,16 @@ function inventoryText(result, now) {
             status.push('canary: verifiable only while watch runs');
         else if (row.verify !== 'not-checked')
             status.push(row.verify);
-        const target = entry?.label ?? row.rootKeyId;
-        if (row.flags.includes('expired'))
-            status.push(`expired; revoke with: macwarden revoke ${target}`);
+        // Every printed command runs as printed with the same connection and --registry flags (RL-05).
+        if (row.flags.includes('expired')) {
+            const target = revokeTarget(rows, row);
+            status.push(target === null ? 'expired' : `expired; revoke with: macwarden revoke ${(0, online_js_1.shellQuote)(target)}`);
+        }
         else if (row.flags.includes('expiring') && row.expires) {
             const left = Date.parse(row.expires) - now;
             const span = left >= 86_400_000 ? `${Math.floor(left / 86_400_000)}d` : `${Math.max(1, Math.ceil(left / 3_600_000))}h`;
-            status.push(`expires in ${span}; rotate with: macwarden rotate ${target}`);
+            const command = rotateCommand(row, now);
+            status.push(command === null ? `expires in ${span}` : `expires in ${span}; rotate with: ${command}`);
         }
         if (row.flags.includes('pending-replacement')) {
             const replacement = rows.find(candidate => candidate.entry?.status === 'active'
@@ -8457,6 +9094,9 @@ function formatDuration(seconds) {
     return `${rest}s`;
 }
 function observationLine(observation) {
+    // seconds null with a coverage record: the record's times could not be evaluated.
+    if (observation.seconds === null && observation.since !== null)
+        return 'window       observation window cannot be computed (invalid watch coverage record); narrowing command withheld';
     const span = observation.seconds === null ? 'observed for an unknown time (no watch coverage recorded)'
         : `observed for ${formatDuration(observation.seconds)} (${observation.sessions} watch session${observation.sessions === 1 ? '' : 's'} since ${safeText(observation.since ?? '')})`;
     if (!observation.short)
@@ -8482,8 +9122,10 @@ function recommendText(result) {
 }
 function bakeText(result, warnings) {
     const aclBestEffort = warnings.some(item => (typeof item === "string" ? item : item.code) === "acl-best-effort");
-    const protection = process.platform !== "win32" ? "0600"
-        : aclBestEffort ? "ACL best effort; file inherits folder permissions" : "restricted Windows ACL";
+    // Printed only after reserveOut verified the result: mode 0600 read back from the open
+    // descriptor, or the owner-only Windows ACL read back while the exclusive handle was held.
+    const protection = process.platform !== "win32" ? "0600, verified"
+        : aclBestEffort ? "no Windows permissions on this volume" : "owner-only Windows ACL, verified";
     const { label, permissions, grade, caveats } = result;
     if (!('dryRun' in result))
         return [
@@ -8726,7 +9368,7 @@ function* renderChunks(result, mode) {
         const lines = batched(format === 'sarif'
             ? (0, scan_formats_js_1.sarifPieces)(result.result, root, result.display?.toolVersion ?? '0.0.0', jsonRedactor())
             : format === 'github'
-                ? (0, scan_formats_js_1.githubLines)(result.result, root, safeText, [...scanSummaryLines(result.result)].join(''))
+                ? (0, scan_formats_js_1.githubLines)(result.result, root, safeText, [...scanSummaryLines(result.result)].join(''), redact)
                 : scanTextLines(result.result));
         // Text and annotation output both go through the line guard; a github annotation's
         // own '::' starts its line on purpose and is produced only by githubLines.
@@ -8858,22 +9500,46 @@ function findingSeverity(finding) {
         default: return { level: 'note', score: '3.0' };
     }
 }
+// alsoAt on a history finding: other paths that added the content; on a work-tree finding:
+// the file's other hard-link names.
+const alsoText = (finding) => finding.commit === undefined ? 'same file also at' : 'same content also added at';
 const gradeLabel = (finding) => finding.kind === 'nwc' ? 'SPEND (NWC)'
     : finding.kind === 'undecodable' || finding.kind === 'undecodable-candidate' ? 'ADMIN (undecodable)'
         : finding.grade ?? 'UNASSESSED';
-/** A finding's path as SARIF/GitHub expect it: relative to the scan root with forward slashes when inside it. */
+/**
+ * A finding's path as SARIF/GitHub expect it: relative to the scan root with forward slashes
+ * when inside it, otherwise absolute. A relative path (scan paths are relative to the working
+ * directory, the scan root) is resolved first, so '../x' is outside the root.
+ */
 function locationOf(path, root) {
-    const rel = (0, node_path_1.isAbsolute)(path) ? (0, node_path_1.relative)(root, path) : path;
-    if ((0, node_path_1.isAbsolute)(rel) || rel === '..' || rel.startsWith(`..${node_path_1.sep}`) || rel.startsWith('../'))
-        return { absolute: path };
-    return { relative: rel.split(node_path_1.sep).join('/').replace(/^\.\//, '') };
+    const absolute = (0, node_path_1.resolve)(root, path);
+    const rel = (0, node_path_1.relative)(root, absolute);
+    if (rel === '' || (0, node_path_1.isAbsolute)(rel) || rel === '..' || rel.startsWith(`..${node_path_1.sep}`))
+        return { absolute };
+    return { relative: rel.split(node_path_1.sep).join('/') };
 }
-/** An absolute path as a file URI (RFC 8089), each segment percent-encoded. */
+const encodeSegments = (parts) => parts.map(encodeURIComponent).join('/');
+/**
+ * An absolute path as a file URI (RFC 8089), each segment percent-encoded as UTF-8. A Windows
+ * path (drive letter, UNC, or the \\?\ and \\.\ forms) takes '\' and '/' as separators; in a
+ * POSIX path '\' is part of a name and is encoded.
+ */
 function fileUri(path) {
-    const parts = path.replace(/\\/g, '/').split('/');
-    const drive = /^[A-Za-z]:$/.test(parts[0] ?? '') ? parts.shift() : null;
-    const encoded = parts.filter((part, index) => index > 0 || part !== '').map(encodeURIComponent).join('/');
-    return drive ? `file:///${drive}/${encoded}` : `file:///${encoded}`;
+    let local = path;
+    let windows = /^[A-Za-z]:[\\/]/.test(local) || /^[\\/]{2}[^\\/]/.test(local);
+    if (/^[\\/]{2}[?.][\\/]/.test(local)) {
+        local = local.slice(4);
+        if (/^UNC[\\/]/i.test(local))
+            local = `\\\\${local.slice(4)}`;
+        windows = true;
+    }
+    if (!windows)
+        return `file://${encodeSegments(local.split('/'))}`;
+    const parts = local.split(/[\\/]/);
+    // UNC \\server\share\x is file://server/share/x; a drive path keeps its colon.
+    if (parts[0] === '' && parts[1] === '')
+        return `file://${encodeURIComponent(parts[2] ?? '')}/${encodeSegments(parts.slice(3))}`;
+    return `file:///${parts[0]}/${encodeSegments(parts.slice(1))}`;
 }
 function artifactLocation(path, root) {
     const where = locationOf(path, root);
@@ -8896,7 +9562,11 @@ function* sarifPieces(result, root, version, replacer) {
     const driver = { name: 'macwarden', version, semanticVersion: version, informationUri: HELP, rules };
     const headJson = JSON.stringify(head, replacer);
     // Columns are Unicode code points from the line start (SPEC, scan); SARIF defaults to UTF-16 units.
-    yield `${headJson.slice(0, -1)},"runs":[{"tool":${JSON.stringify({ driver }, replacer)},"columnKind":"unicodeCodePoints","results":[`;
+    // %SRCROOT% is declared as the scan root, so every relative result URI resolves to its file.
+    const rootUri = fileUri((0, node_path_1.resolve)(root));
+    const baseIds = { '%SRCROOT%': { uri: rootUri.endsWith('/') ? rootUri : `${rootUri}/` } };
+    yield `${headJson.slice(0, -1)},"runs":[{"tool":${JSON.stringify({ driver }, replacer)},`
+        + `"originalUriBaseIds":${JSON.stringify(baseIds, replacer)},"columnKind":"unicodeCodePoints","results":[`;
     let first = true;
     let emitted = 0;
     for (const finding of result.findings) {
@@ -8914,14 +9584,14 @@ function* sarifPieces(result, root, version, replacer) {
             location.logicalLocations = [{ name: finding.commit, kind: 'commit' }];
         const related = finding.alsoAt?.paths.map((path, index) => ({ id: index + 1,
             physicalLocation: { artifactLocation: artifactLocation(path, root) },
-            message: { text: 'same content also added here' } }));
+            message: { text: finding.commit === undefined ? 'same file (hard link) also here' : 'same content also added here' } }));
         const sarifResult = {
             ruleId, ruleIndex, level,
             message: { text: `${finding.kind} credential, grade ${gradeLabel(finding)}, ${finding.fingerprint}`
                     + (finding.rootKeyId === null ? '' : `, root key ${finding.rootKeyId}`)
                     + (finding.commit === undefined ? '' : `, added in commit ${finding.commit}`)
                     + (finding.context === 'mcp-config' ? ', configured for an AI agent (MCP server)' : '')
-                    + (finding.alsoAt ? `, same content also added at ${finding.alsoAt.count} other path(s)` : '') },
+                    + (finding.alsoAt ? `, ${alsoText(finding)} ${finding.alsoAt.count} other path(s)` : '') },
             locations: [location],
             ...(related?.length ? { relatedLocations: related } : {}),
             partialFingerprints: { 'macwardenFingerprint/v1': finding.fingerprint },
@@ -8952,14 +9622,18 @@ function escapeData(value) {
 function escapeProperty(value) {
     return escapeData(value).replace(/:/g, '%3A').replace(/,/g, '%2C');
 }
-/** GitHub Actions annotations, one per finding, then the text summary line. */
-function* githubLines(result, root, clean, summary) {
+/**
+ * GitHub Actions annotations, one per finding, then the text summary line. `clean` escapes
+ * the message for display; the file property carries the real path (credentials redacted by
+ * `redact`) with GitHub's own property escaping, so the annotation names the actual file.
+ */
+function* githubLines(result, root, clean, summary, redact = text => text) {
     for (const finding of result.findings) {
         const { level } = findingSeverity(finding);
         const command = level === 'error' ? 'error' : level === 'warning' ? 'warning' : 'notice';
         const where = locationOf(finding.path, root);
         const file = 'relative' in where ? where.relative : where.absolute;
-        const properties = [`file=${escapeProperty(clean(file))}`];
+        const properties = [`file=${escapeProperty(redact(file))}`];
         if (finding.line !== null)
             properties.push(`line=${finding.line}`);
         if (finding.column !== null)
@@ -8969,7 +9643,7 @@ function* githubLines(result, root, clean, summary) {
             + (finding.rootKeyId === null ? '' : ` root key ${finding.rootKeyId}`)
             + (finding.commit === undefined ? '' : ` in commit ${finding.commit.slice(0, 12)}`)
             + (finding.context === 'mcp-config' ? ' (MCP server config)' : '')
-            + (finding.alsoAt ? ` (same content also added at ${finding.alsoAt.count} other path(s))` : '');
+            + (finding.alsoAt ? ` (${alsoText(finding)} ${finding.alsoAt.count} other path(s))` : '');
         yield `::${command} ${properties.join(',')}::${escapeData(clean(message))}\n`;
     }
     yield summary;
@@ -9002,6 +9676,7 @@ function internalErrorMessage(state) {
 "use strict";
 exports.__esModule = true;
 exports.isProtectedPath = isProtectedPath;
+exports.outputNameProblem = outputNameProblem;
 exports.resolveUnprotectedPath = resolveUnprotectedPath;
 const node_path_1 = require("node:path");
 // SAFE-02 names are refused as complete path components before opening them.
@@ -9014,6 +9689,38 @@ function isProtectedPath(path) {
             /^(?:wallet[-_.]?password(?:\..+)?|seeds?(?:\..+)?|tls[-_.]?(?:key|privkey)(?:\..+)?)$/.test(name);
     });
 }
+// Names Win32 path normalisation changes or maps to a device. Node opens the literal
+// \\?\ object while Win32 tools (and other programs) open the normalised name, so a
+// credential file must never carry one. COM/LPT also match the superscript digits.
+const WINDOWS_DEVICE = /^(?:con|prn|aux|nul|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3]|conin\$|conout\$)(?:[ .]|$)/i;
+// eslint-disable-next-line no-control-regex
+const WINDOWS_INVALID = /[<>:"|?*\u0000-\u001f]/;
+/**
+ * Why an output path cannot be written as given on Windows, or null. Every component
+ * after the drive or UNC share is checked: a trailing dot or space, a reserved device
+ * name (with or without an extension, any case), ':' (an alternate data stream) or a
+ * character Windows forbids. Device namespace paths (\\.\) are refused. Other
+ * platforms accept these names, so the check applies only on Windows.
+ */
+function outputNameProblem(path, platform = process.platform) {
+    if (platform !== 'win32')
+        return null;
+    const absolute = node_path_1.win32.resolve(path);
+    if (/^[\\/]{2}\.[\\/]/.test(absolute))
+        return 'a Windows device namespace path (\\\\.\\) is refused';
+    const root = node_path_1.win32.parse(absolute).root;
+    for (const component of absolute.slice(root.length).split('\\')) {
+        if (!component)
+            continue;
+        if (WINDOWS_INVALID.test(component))
+            return 'a path component contains ":" (an alternate data stream) or a character Windows does not allow in names';
+        if (/[. ]$/.test(component))
+            return 'a path component ends with a dot or a space, which Windows removes';
+        if (WINDOWS_DEVICE.test(component))
+            return 'a path component is a reserved Windows device name (CON, PRN, AUX, NUL, COM1-9, LPT1-9)';
+    }
+    return null;
+}
 async function resolveUnprotectedPath(path, fs) {
     if (isProtectedPath(path))
         throw new Error('protected path');
@@ -9093,6 +9800,8 @@ exports.Registry = exports.RegistryUsageError = exports.RegistryInputError = voi
 exports.openRegistry = openRegistry;
 exports.replacementProblem = replacementProblem;
 exports.replacementLinkProblems = replacementLinkProblems;
+exports.recordedFileRelation = recordedFileRelation;
+exports.isStagedReplacement = isStagedReplacement;
 exports.hasCustomCaveat = hasCustomCaveat;
 const process_domain_js_1 = require("./process-domain.js");
 const nodeFs = __importStar(require("node:fs/promises"));
@@ -9101,7 +9810,8 @@ const node_path_1 = require("node:path");
 const node_crypto_1 = require("node:crypto");
 const protected_path_js_1 = require("../protected-path.js");
 const bounded_file_js_1 = require("../bounded-file.js");
-const maxRootKeyId = 18446744073709551615n;
+const instant_js_1 = require("../instant.js");
+const root_key_id_js_1 = require("../root-key-id.js");
 const fields = ['nodePubkey', 'label', 'rootKeyId', 'permissions', 'caveats', 'grade',
     'fingerprint', 'outPath', 'createdAt', 'verified', 'status', 'revokedAt',
     'revokeEvidence', 'replaces', 'replacedBy'];
@@ -9136,13 +9846,12 @@ function exactFields(value, expected) {
     const keys = Object.keys(value);
     return keys.length === expected.length && keys.every(key => expected.includes(key));
 }
-function decimalId(value) {
-    return typeof value === 'string' && /^(0|[1-9][0-9]*)$/.test(value)
-        && BigInt(value) <= maxRootKeyId;
-}
-function timestamp(value) {
-    return typeof value === 'string' && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/.test(value)
-        && !Number.isNaN(Date.parse(value));
+const decimalId = root_key_id_js_1.isRootKeyId;
+// A real instant, not only its shape: 30 February or 24:00 would be read as another day.
+const timestamp = instant_js_1.isInstant;
+/** A recorded expiry duration, as `bake --expires` accepts it (RL-03): rotate S11 reuses it. */
+function duration(value) {
+    return typeof value === 'string' && /^[1-9][0-9]{0,4}[mhd]$/.test(value);
 }
 function validEntry(value) {
     if (!isRecord(value) || !exactFields(value, fields))
@@ -9158,7 +9867,7 @@ function validEntry(value) {
         && Object.hasOwn(caveat, 'type') && Object.hasOwn(caveat, 'value')
         && typeof caveat.type === 'string' && caveatTypes.has(caveat.type)
         && typeof caveat.value === 'string'
-        && (caveat.requested === undefined || typeof caveat.requested === 'string')))
+        && (caveat.requested === undefined || (caveat.type === 'time-before' && duration(caveat.requested)))))
         return false;
     return typeof value.grade === 'string' && grades.has(value.grade)
         && ((typeof value.fingerprint === 'string' && /^fp:[0-9a-f]{16}$/.test(value.fingerprint))
@@ -9228,9 +9937,14 @@ function alive(pid) {
         return error.code !== 'ESRCH';
     }
 }
+const LOCK_TOKEN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+// `token` (from 1.1.1) is a random per-acquisition nonce that binds release to this owner's
+// record; records written without it by earlier versions stay valid.
 function validLock(value) {
     return isRecord(value) && (exactFields(value, ['pid', 'hostname', 'startedAt'])
-        || exactFields(value, ['pid', 'hostname', 'startedAt', 'processDomain']))
+        || exactFields(value, ['pid', 'hostname', 'startedAt', 'processDomain'])
+        || exactFields(value, ['pid', 'hostname', 'startedAt', 'processDomain', 'token']))
+        && (value.token === undefined || (typeof value.token === 'string' && LOCK_TOKEN.test(value.token)))
         && Number.isSafeInteger(value.pid) && value.pid > 0
         && typeof value.hostname === 'string' && /^[A-Za-z0-9_.-]+$/.test(value.hostname)
         && timestamp(value.startedAt)
@@ -9240,6 +9954,7 @@ class Registry {
     fs;
     deps;
     path;
+    /** The lock this registry holds: its file identity and the exact owner record written. */
     ownedLock;
     entries;
     originalText;
@@ -9446,11 +10161,12 @@ class Registry {
             try {
                 const handle = await this.fs.open(lockPath, 'wx', 0o600);
                 try {
-                    await handle.writeFile(JSON.stringify({ pid: process.pid,
-                        hostname: (this.deps.hostname ?? node_os_1.hostname)(), startedAt: new Date().toISOString(), processDomain }));
-                    const stat = await handle.stat();
+                    const record = JSON.stringify({ pid: process.pid, hostname: (this.deps.hostname ?? node_os_1.hostname)(),
+                        startedAt: new Date().toISOString(), processDomain, token: (0, node_crypto_1.randomUUID)() });
+                    await handle.writeFile(record);
+                    const stat = await handle.stat({ bigint: true });
                     await handle.close();
-                    this.ownedLock = { dev: stat.dev, ino: stat.ino };
+                    this.ownedLock = { dev: stat.dev, ino: stat.ino, birth: stat.birthtimeNs, record };
                 }
                 catch {
                     await handle.close().catch(() => { });
@@ -9465,9 +10181,9 @@ class Registry {
             }
             let lock;
             try {
-                // The lock is ours to read only as a plain file: never through a symlink (SAFE-02).
-                await (0, bounded_file_js_1.assertPlainFile)(lockPath, this.fs, bounded_file_js_1.LOCK_FILE_LIMIT);
-                const text = await this.fs.readFile(lockPath, 'utf8');
+                // The lock is ours to read only as a plain file: never through a symlink (SAFE-02),
+                // through one descriptor bound to the checked file and at most LOCK_FILE_LIMIT + 1 bytes.
+                const text = await (0, bounded_file_js_1.readPlainFile)(lockPath, this.fs, bounded_file_js_1.LOCK_FILE_LIMIT);
                 lock = JSON.parse(text);
             }
             catch {
@@ -9492,9 +10208,10 @@ class Registry {
                 before = await this.fs.lstat(lockPath);
                 if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.ino === 0)
                     input('registry-lock', 'stale lock ownership ambiguous; stop writers and recover offline');
-                if (await this.fs.readFile(lockPath, 'utf8') !== JSON.stringify(lock)) {
+                const text = await (0, bounded_file_js_1.readPlainFile)(lockPath, this.fs, bounded_file_js_1.LOCK_FILE_LIMIT);
+                if (text !== JSON.stringify(lock)) {
                     // Whitespace is allowed, but the owner must still be identical.
-                    const reread = JSON.parse(await this.fs.readFile(lockPath, 'utf8'));
+                    const reread = JSON.parse(text);
                     if (!validLock(reread) || JSON.stringify(reread) !== JSON.stringify(lock))
                         input('registry-lock', 'registry lock changed; stop writers and recover offline');
                 }
@@ -9505,7 +10222,7 @@ class Registry {
                 await this.fs.rename(lockPath, quarantine);
                 quarantined = true;
                 const moved = await this.fs.lstat(quarantine);
-                const movedOwner = JSON.parse(await this.fs.readFile(quarantine, 'utf8'));
+                const movedOwner = JSON.parse(await (0, bounded_file_js_1.readPlainFile)(quarantine, this.fs, bounded_file_js_1.LOCK_FILE_LIMIT));
                 if (moved.dev !== before.dev || moved.ino !== before.ino || !validLock(movedOwner)
                     || JSON.stringify(movedOwner) !== JSON.stringify(lock) || (this.deps.pidAlive ?? alive)(lock.pid)) {
                     // Never overwrite a replacement writer's pathname. Hard-link restoration
@@ -9585,8 +10302,14 @@ class Registry {
             return;
         try {
             const lockPath = `${this.path}.lock`;
-            const stat = await this.fs.lstat(lockPath);
-            if (!stat.isFile() || stat.dev !== owned.dev || stat.ino !== owned.ino)
+            const stat = await this.fs.lstat(lockPath, { bigint: true });
+            // Birth time (0 where the file system has none) tells most recycled inodes apart too.
+            if (!stat.isFile() || stat.dev !== owned.dev || stat.ino !== owned.ino || stat.birthtimeNs !== owned.birth)
+                input('registry-lock', 'registry lock owner changed; preserved competing lock');
+            // A file system may hand a freed inode number to the next file at once, so identity
+            // alone cannot tell a replaced lock apart: the record, with this acquisition's token,
+            // must be exactly the one written.
+            if (await (0, bounded_file_js_1.readPlainFile)(lockPath, this.fs, bounded_file_js_1.LOCK_FILE_LIMIT) !== owned.record)
                 input('registry-lock', 'registry lock owner changed; preserved competing lock');
             await this.fs.unlink(lockPath);
         }
@@ -9640,10 +10363,34 @@ function replacementProblem(old, next) {
         return 'its label differs';
     if (next.rootKeyId === old.rootKeyId)
         return 'it has the same root key ID';
-    if (Date.parse(next.createdAt) < Date.parse(old.createdAt))
-        return 'it was created before the credential it replaces';
+    if (Date.parse(next.createdAt) < Date.parse(old.createdAt) && !rotateWrittenShape(old, next))
+        return 'it was created before the credential it replaces (if macwarden staged it while this machine\'s clock ' +
+            `was behind, abandon it with macwarden revoke ${next.rootKeyId} and stage again)`;
     return null;
 }
+/**
+ * True when a replacement recorded as created before `old` is the link 1.1.0's own stage wrote
+ * under a clock behind O's recorded creation time (RL-02): 1.1.0 recorded N.createdAt as the
+ * local clock at S10, so an NTP step back, a resumed VM or O baked while the clock ran ahead made
+ * macwarden's own link look "created before" O, and finish, respond and inventory then refused
+ * it as tampering. Such a link has exactly the shape rotate writes: O's permissions (as a set)
+ * and grade, at most one caveat and only `time-before` (S11), no `replacedBy`, `createdAt` as
+ * `Date.toISOString()` writes it, and a gap no larger than a clock error (24 hours). The time
+ * order is a plausibility check, not a boundary (whoever can edit the registry can edit
+ * createdAt too), and a link of this shape grants no more than O; a link that is older, broader
+ * or carries anything rotate would not write stays tampering. 1.1.1 records N.createdAt as
+ * max(now, O.createdAt), so it no longer writes such links.
+ */
+const CLOCK_ERROR_MS = 86_400_000;
+function rotateWrittenShape(old, next) {
+    const permissions = new Set(old.permissions);
+    return next.permissions.length === permissions.size && next.permissions.every(permission => permissions.has(permission))
+        && new Set(next.permissions).size === next.permissions.length
+        && next.grade === old.grade && next.replacedBy === null
+        && next.caveats.length <= 1 && next.caveats.every(caveat => caveat.type === 'time-before')
+        && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(next.createdAt)
+        && Date.parse(old.createdAt) - Date.parse(next.createdAt) <= CLOCK_ERROR_MS;
+}
 /**
  * Every active staged-replacement link that macwarden could not have written. A link is an
  * active entry whose `replaces` names an active entry on the same node (a rotation that
@@ -9676,6 +10423,36 @@ function replacementLinkProblems(entries) {
     }
     return problems;
 }
+/**
+ * How the credential file found at an entry's recorded `outPath` relates to that entry (RL-01).
+ * - `match`: the entry's credential (same root key ID and fingerprint).
+ * - `other-credential`: a credential on another root key ID. The path was reused, for example
+ *   when the operator baked or staged a replacement where the app reads its file. It says
+ *   nothing about this entry, so the entry is handled as having no usable file (proof by ID).
+ * - `same-root-key`: the entry's root key ID with another fingerprint (another macaroon on that
+ *   root key, such as an attenuated copy, or an edited fingerprint).
+ * - `tampered`: the entry's fingerprint on another root key ID. A fingerprint covers the
+ *   identifier, which carries the root key ID, so the entry's root key ID or fingerprint was edited.
+ */
+function recordedFileRelation(entry, facts) {
+    const sameId = facts.rootKeyId === BigInt(entry.rootKeyId);
+    const sameFingerprint = facts.fingerprint === entry.fingerprint;
+    if (sameId)
+        return sameFingerprint ? 'match' : 'same-root-key';
+    return sameFingerprint ? 'tampered' : 'other-credential';
+}
+/**
+ * Whether `entry` is a staged (pending) replacement: an active entry whose `replaces` names an
+ * active entry on the same node (SPEC 6). One definition for rotate, respond and inventory
+ * (RL-07): a `replaces` naming a revoked entry (a finished rotation) or an entry no longer in
+ * the registry (pruned) does not make the entry a replacement, so it is an original that can
+ * be rotated again.
+ */
+function isStagedReplacement(entries, entry) {
+    const node = entry.nodePubkey.toLowerCase();
+    return entry.status === 'active' && entry.replaces !== null && entries.some(old => old.status === 'active'
+        && old.nodePubkey.toLowerCase() === node && old.rootKeyId === entry.replaces);
+}
 /** An lnd-custom caveat (a canary, or any custom caveat) that a rotation cannot reproduce. */
 function hasCustomCaveat(entry) {
     return entry.caveats.some(caveat => caveat.type === 'lnd-custom');
@@ -10013,6 +10790,23 @@ function formatAccessReview(review, format) {
     return lines.join('\n');
 }
 
+},
+"root-key-id.js": (module, exports, require) => {
+"use strict";
+// Root key IDs are uint64 and always canonical decimal strings in JSON (SPEC, Output).
+exports.__esModule = true;
+exports.MAX_ROOT_KEY_ID = void 0;
+exports.isRootKeyId = isRootKeyId;
+exports.MAX_ROOT_KEY_ID = 18446744073709551615n;
+/**
+ * True for a canonical decimal uint64: digits only, no leading zero except "0" itself, at most
+ * 18446744073709551615. The one rule for every root key ID macwarden reads (registry, usage
+ * and canary records, command selectors), so no reader accepts an ID another one refuses.
+ */
+function isRootKeyId(value) {
+    return typeof value === 'string' && /^(?:0|[1-9][0-9]{0,19})$/.test(value) && BigInt(value) <= exports.MAX_ROOT_KEY_ID;
+}
+
 },
 "scan/agent-configs.js": (module, exports, require) => {
 "use strict";
@@ -10165,11 +10959,15 @@ exports.readBlobs = readBlobs;
 // make an offline scan open SMB connections. locateRepository() resolves all of them in
 // JavaScript first, refuses any that are not on a local file system before touching them,
 // and the git processes then run with GIT_DIR and GIT_WORK_TREE pinned to the result.
+// Every location is also checked against the protected names (SAFE-02) on its supplied path
+// and resolved target before it is opened, because git would read the same files.
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs/promises"));
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
+const bounded_file_js_1 = require("../bounded-file.js");
 const cancellation_js_1 = require("../cancellation.js");
+const protected_path_js_1 = require("../protected-path.js");
 class GitHistoryError extends Error {
     constructor(message) { super(message); this.name = 'GitHistoryError'; }
 }
@@ -10192,6 +10990,7 @@ exports.PINNED_CONFIG = [
     'log.mailmap=false', 'mailmap.file=', 'mailmap.blob=',
 ].flatMap(setting => ['-c', setting]);
 const NOT_LOCAL = 'git history requires a repository on a local file system';
+const PROTECTED = 'git history would open a protected file';
 const NOT_WORK_TREE = 'path is not inside a git work tree';
 /**
  * True when `path` (absolute) names a network or device location: on Windows a UNC
@@ -10214,25 +11013,35 @@ const MAX_LOCATION_FILE = 64 * 1024;
 function absolute(base, value) {
     return (0, node_path_1.isAbsolute)(value) || (process.platform === 'win32' && node_path_1.win32.isAbsolute(value)) ? (0, node_path_1.resolve)(value) : (0, node_path_1.resolve)(base, value);
 }
-/** Resolves a path named inside the repository; refuses non-local ones before any I/O. */
-async function local(base, value) {
+/**
+ * Resolves a path named inside the repository. Refuses non-local ones before any I/O, and
+ * (SAFE-02) one whose supplied path or resolved target has a protected file or directory
+ * component before anything there is opened.
+ */
+async function local(io, base, value) {
     const path = absolute(base, value);
     if (nonLocalPath(path))
         throw new GitHistoryError(NOT_LOCAL);
-    const real = await fs.realpath(path).catch(() => null);
+    if ((0, protected_path_js_1.isProtectedPath)(path))
+        throw new GitHistoryError(PROTECTED);
+    const real = await io.realpath(path).catch(() => null);
     if (real !== null && nonLocalPath(real))
         throw new GitHistoryError(NOT_LOCAL);
+    if (real !== null && (0, protected_path_js_1.isProtectedPath)(real))
+        throw new GitHistoryError(PROTECTED);
     return real ?? path;
 }
 exports.PREFLIGHT_LIMITS = { files: 256, bytes: 1024 * 1024, edges: 4096 };
 /** One preflight: budgets, counters, memoized results and the chain currently being walked. */
 class Preflight {
+    io;
     stats;
     limits;
     /** Canonical location → its expansion, once validated. Each location is read at most once. */
     done = new Map();
     walking = new Set();
-    constructor(limits = {}, stats) {
+    constructor(io, limits = {}, stats) {
+        this.io = io;
         this.limits = { ...exports.PREFLIGHT_LIMITS, ...limits };
         this.stats = Object.assign(stats ?? {}, { files: 0, bytes: 0, edges: 0, expandedEdges: 0, expandedBytes: 0 });
     }
@@ -10246,18 +11055,34 @@ class Preflight {
             throw new GitHistoryError(UNREADABLE);
     }
     edge() { this.stats.edges++; this.step(); }
+    /**
+     * Reads one location file, or null when it is absent or not a regular file. A protected
+     * path or resolved target (SAFE-02) is refused before it is opened; the content is read
+     * through one descriptor checked to be the regular file that was resolved, and at most
+     * MAX_LOCATION_FILE + 1 bytes are ever read.
+     */
     async small(path) {
         this.stats.files++;
         this.step();
-        const stat = await fs.stat(path).catch(() => null);
-        if (!stat?.isFile())
-            return null;
-        if (stat.size > MAX_LOCATION_FILE)
-            throw new GitHistoryError(UNREADABLE);
-        const bytes = await fs.readFile(path);
-        // The file may have grown between stat and read: count and bound what was actually read.
-        if (bytes.length > MAX_LOCATION_FILE)
+        if ((0, protected_path_js_1.isProtectedPath)(path))
+            throw new GitHistoryError(PROTECTED);
+        let bytes;
+        try {
+            bytes = await (0, bounded_file_js_1.readBoundedFile)(path, this.io, MAX_LOCATION_FILE);
+        }
+        catch (error) {
+            if (error instanceof bounded_file_js_1.BoundedFileError) {
+                if (error.message === 'protected file')
+                    throw new GitHistoryError(PROTECTED);
+                if (error.message === 'not a regular file')
+                    return null;
+                throw new GitHistoryError(UNREADABLE);
+            }
+            // Absent or inaccessible: git would not read it either.
+            if (['ENOENT', 'ENOTDIR', 'EACCES', 'EPERM', 'ELOOP'].includes(error.code ?? ''))
+                return null;
             throw new GitHistoryError(UNREADABLE);
+        }
         this.stats.bytes += bytes.length;
         this.step();
         return bytes.toString('utf8');
@@ -10331,7 +11156,7 @@ function checkAlternates(run, objects, depth) {
             if (!line || line.startsWith('#'))
                 continue;
             run.edge();
-            run.follow(own, await checkAlternates(run, await local(objects, unquoteAlternate(line)), depth + 1));
+            run.follow(own, await checkAlternates(run, await local(run.io, objects, unquoteAlternate(line)), depth + 1));
         }
         return own;
     });
@@ -10380,7 +11205,7 @@ function checkIncludes(run, file, depth) {
                 run.follow(own, NOTHING);
                 continue;
             }
-            run.follow(own, await checkIncludes(run, await local((0, node_path_1.dirname)(file), named), depth + 1));
+            run.follow(own, await checkIncludes(run, await local(run.io, (0, node_path_1.dirname)(file), named), depth + 1));
         }
         return own;
     });
@@ -10396,17 +11221,18 @@ function ceilings() {
  * directory or gitfile in it or a parent) and validates every location git would read.
  */
 async function locateRepository(directory, options = {}) {
-    const run = new Preflight(options.limits, options.stats);
+    const io = options.io ?? fs;
+    const run = new Preflight(io, options.limits, options.stats);
     if (nonLocalPath((0, node_path_1.resolve)(directory)))
         throw new GitHistoryError(NOT_LOCAL);
-    let current = await fs.realpath(directory).catch(() => { throw new GitHistoryError(NOT_WORK_TREE); });
+    let current = await io.realpath(directory).catch(() => { throw new GitHistoryError(NOT_WORK_TREE); });
     if (nonLocalPath(current))
         throw new GitHistoryError(NOT_LOCAL);
     const ceiling = ceilings();
     const key = (path) => process.platform === 'win32' ? path.toLowerCase() : path;
     for (;;) {
         const candidate = (0, node_path_1.join)(current, '.git');
-        const stat = await fs.lstat(candidate).catch(() => null);
+        const stat = await io.lstat(candidate).catch(() => null);
         if (stat) {
             let gitDir;
             if (stat.isFile()) {
@@ -10414,15 +11240,15 @@ async function locateRepository(directory, options = {}) {
                 const target = text === null ? null : /^gitdir:\s*(.+?)\s*$/m.exec(text)?.[1];
                 if (!target)
                     throw new GitHistoryError(NOT_WORK_TREE);
-                gitDir = await local(current, target);
+                gitDir = await local(io, current, target);
             }
             else
-                gitDir = await local(current, candidate);
-            const gitStat = await fs.stat(gitDir).catch(() => null);
+                gitDir = await local(io, current, candidate);
+            const gitStat = await io.stat(gitDir).catch(() => null);
             if (!gitStat?.isDirectory())
                 throw new GitHistoryError(NOT_WORK_TREE);
             const common = await run.small((0, node_path_1.join)(gitDir, 'commondir'));
-            const commonDir = common === null ? gitDir : await local(gitDir, common.trim());
+            const commonDir = common === null ? gitDir : await local(io, gitDir, common.trim());
             run.root(await checkAlternates(run, (0, node_path_1.join)(commonDir, 'objects'), 0));
             run.root(await checkIncludes(run, (0, node_path_1.join)(commonDir, 'config'), 0));
             run.root(await checkIncludes(run, (0, node_path_1.join)(gitDir, 'config.worktree'), 0));
@@ -10858,7 +11684,20 @@ function parseIgnoreFile(content) {
         const match = /^(fp:[0-9a-fA-F]{16})(?:\s+(\S+))?$/.exec(line);
         if (!match)
             throw new IgnoreFileError();
-        const matches = match[2] === undefined ? () => true : globMatcher(match[2]);
+        const glob = match[2];
+        let matches;
+        if (glob === undefined)
+            matches = () => true;
+        else if (glob.startsWith('/')) {
+            // As in .gitignore, a leading '/' anchors the glob at the ignore file's directory. Globs
+            // already match whole relative paths, so the '/' is dropped for them; an absolute
+            // reported path (--ignore-file) is matched against the glob as written.
+            const anchored = globMatcher(glob.slice(1));
+            const absolute = globMatcher(glob);
+            matches = path => path.startsWith('/') ? absolute(path) : anchored(path);
+        }
+        else
+            matches = globMatcher(glob);
         if (entries.length >= 1024)
             throw new IgnoreFileError();
         entries.push({ fingerprint: match[1].toLowerCase(), matches });
@@ -10903,7 +11742,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 exports.__esModule = true;
-exports.readBounded = exports.SCAN_CONCURRENCY = exports.FindingsLimitError = exports.HISTORY_DEDUP_WORK_LIMIT = exports.ALSO_AT_EXAMPLES = exports.FINDINGS_LIMIT = exports.GitHistoryError = exports.IgnoreFileError = void 0;
+exports.SCAN_OPEN_FLAGS = exports.readBounded = exports.SCAN_CONCURRENCY = exports.FindingsLimitError = exports.HISTORY_DEDUP_WORK_LIMIT = exports.ALSO_AT_EXAMPLES = exports.FINDINGS_LIMIT = exports.CANDIDATE_LIMIT = exports.GitHistoryError = exports.IgnoreFileError = void 0;
 exports.scan = scan;
 const mcp_context_js_1 = require("./mcp-context.js");
 const node_crypto_1 = require("node:crypto");
@@ -10952,14 +11791,61 @@ const detectors = [
     { kind: 'nwc', pattern: patterns_js_1.nwc },
     { kind: 'macaroon-hex', pattern: patterns_js_1.macaroonHex },
     { kind: 'macaroon-base64', pattern: patterns_js_1.macaroonBase64 },
+    // RR-10, scan only (not part of the published patterns): hex with a separator between every
+    // byte (colon hex, xxd -g1, spaced bytes) is decoded; the prefix of an xxd default dump
+    // (two-byte groups, either alignment) is a candidate, since a dump spans several lines.
+    { kind: 'macaroon-hex', pattern: /02[: -]01[: -]03[: -]6c[: -]6e[: -]64[: -]02(?:[: -][0-9a-f]{2}){20,}/i },
+    { kind: 'macaroon-hex', pattern: /0201 036c 6e64 02(?:[0-9a-f]{2})?|02 0103 6c6e 6402/i },
+];
+// RR-10: a prefix whose continuation is shorter than the published patterns need and that
+// ends its line may be a credential wrapped narrower than 49 columns. It is joined with the
+// following lines of the same alphabet and reported when the joined text decodes.
+const NARROW_WRAP = [
+    { kind: 'macaroon-base64', start: /AgEDbG5kA[A-Za-z0-9+/_-]{0,39}\s*$/, more: /^[A-Za-z0-9+/_-]+={0,2}$/ },
+    { kind: 'macaroon-hex', start: /0201036c6e6402[0-9a-f]{0,39}\s*$/i, more: /^[0-9a-f]+$/i },
 ];
 const detectorRegexes = detectors.map(({ kind, pattern }) => ({ kind, regex: new RegExp(pattern.source, `${pattern.flags.replace('g', '')}g`) }));
 // Every detector match contains one of these (case-insensitive superset), so a line
 // without any of them cannot produce a hit and is not split into code points.
 // "walletconnect%3a" covers percent-encoded NWC URIs, which are matched on a normalised copy.
-const MAY_MATCH = /lndconnect:\/\/|walletconnect:|walletconnect%3a|0201036c6e6402|AgEDbG5kA/i;
-const WINDOW = 65_536;
-const STEP = 32_768;
+const PLAIN_MAY_MATCH = /lndconnect:\/\/|walletconnect:|walletconnect%3a|0201036c6e6402|AgEDbG5kA|02[: -]01[: -]03[: -]6c|0201 036c 6e64 02|02 0103 6c6e 6402/i;
+/**
+ * The part of base64(prefix) that does not depend on the bytes before or after the prefix,
+ * for each of the three byte alignments: text that holds the base64 of a text credential
+ * (a Kubernetes Secret's data, Helm values) holds one of these.
+ */
+function encodedCores(prefix) {
+    return [0, 1, 2].map(lead => {
+        const encode = (fill) => Buffer.concat([Buffer.alloc(lead, fill), Buffer.from(prefix), Buffer.alloc(3, fill)]).toString('base64');
+        const [low, high] = [encode(0), encode(0xff)];
+        let best = '';
+        for (let at = 0, run = 0; at < low.length; at++) {
+            run = low[at] === high[at] ? run + 1 : 0;
+            if (run > best.length)
+                best = low.slice(at - run + 1, at + 1);
+        }
+        return best;
+    });
+}
+const ENCODED_PREFIXES = ['0201036c6e6402', '0201036C6E6402', 'AgEDbG5kA', 'lndconnect://'];
+// Base64 that may hold a text credential. Case matters: it is matched on the encoded text.
+const ENCODED_CANDIDATE = new RegExp(ENCODED_PREFIXES.flatMap(encodedCores)
+    .map(core => core.replace(/[+/]/g, match => `\\${match}`)).join('|'));
+// A line that cannot produce a hit, plain or encoded, is not split into code points.
+const MAY_MATCH = { test: (text) => PLAIN_MAY_MATCH.test(text) || ENCODED_CANDIDATE.test(text) };
+/**
+ * Every detector match of up to this many code points is matched whole wherever it starts in
+ * a line. It covers the largest supported credential encodings with room to spare: the hex of
+ * a 64 KiB credential (131,072), its base64 or base64url (87,382) with lndconnect host and
+ * certificate parameters, and NWC URIs. A match still cut by a window end is reported as an
+ * undecodable-candidate, never dropped.
+ */
+exports.CANDIDATE_LIMIT = 262_144;
+// Windows start every CANDIDATE_LIMIT code points and are long enough that a match starting
+// anywhere in the first CANDIDATE_LIMIT code points has CANDIDATE_LIMIT code points of room.
+// Each code point is matched at most twice, so time and memory stay linear in the line.
+const STEP = exports.CANDIDATE_LIMIT;
+const WINDOW = STEP + exports.CANDIDATE_LIMIT - 1;
 function fingerprint(data) {
     return `fp:${(0, node_crypto_1.createHash)('sha256').update(data).digest('hex').slice(0, 16)}`;
 }
@@ -11014,31 +11900,69 @@ function decodeBase64(value) {
         return null;
     return bytes;
 }
+function decoded(bytes) {
+    try {
+        return (0, index_js_1.decodeMacaroon)(new secret_js_1.Secret(bytes));
+    }
+    catch (error) {
+        if (!(error instanceof index_js_1.DecodeError))
+            throw error;
+        return null;
+    }
+}
 function credentialBytes(hit) {
     if (hit.kind === 'macaroon-hex') {
-        if (hit.text.length % 2 !== 0)
+        // Byte separators (RR-10) carry no data.
+        const digits = hit.text.replace(/[: -]/g, '');
+        if (digits.length % 2 !== 0)
             return null;
-        return Buffer.from(hit.text, 'hex');
+        return Buffer.from(digits, 'hex');
     }
     if (hit.kind === 'macaroon-base64')
         return decodeBase64(hit.text);
-    if (hit.kind !== 'lndconnect')
-        return null;
-    return (0, lndconnect_js_1.parseLndconnect)(hit.text);
+    return null;
+}
+/**
+ * Whether a match that ends at its window's end would be longer in the whole line: the same
+ * detector, anchored at the match, matches more of the match followed by the next code point.
+ */
+function continues(kind, text, next, regex) {
+    if (kind === 'nwc')
+        return false;
+    const sticky = new RegExp(regex.source, `${regex.flags.replace('g', '')}y`);
+    const longer = sticky.exec(text + next);
+    return longer !== null && longer[0].length > text.length;
 }
 function collectHits(points, only) {
     const hits = new Map();
+    const truncated = new Map();
     for (let offset = 0; offset < points.length; offset += STEP) {
         const window = points.slice(offset, offset + WINDOW).join('');
+        // The line continues past this window: a match reaching its end may be cut.
+        const cut = offset + WINDOW < points.length ? points[offset + WINDOW] : null;
+        // This window has more room for any match starting in it than the earlier ones had, so
+        // it decides again about every earlier cut match that starts here.
+        for (const [key, hit] of truncated) {
+            if (hit.start >= offset) {
+                hits.delete(key);
+                truncated.delete(key);
+            }
+        }
         for (const { kind, regex } of detectorRegexes) {
-            if (only !== undefined && kind !== only)
+            if (only !== undefined && !only.includes(kind))
                 continue;
             regex.lastIndex = 0;
             let codeUnit = 0;
             let codePoint = 0;
             // NWC uses a linear matcher equivalent to the published regex (src/scan/nwc-match.ts).
-            const found = kind === 'nwc' ? (0, nwc_match_js_1.nwcMatches)(window).map(item => ({ index: item.index, 0: item.text }))
-                : window.matchAll(regex);
+            // A prefix whose URI runs to the window end without a secret may be cut by the window.
+            const open = [];
+            const found = kind === 'nwc'
+                ? (0, nwc_match_js_1.nwcMatches)(window, cut === null ? undefined : open).map(item => ({ index: item.index, 0: item.text }))
+                : [...window.matchAll(regex)];
+            for (const index of open)
+                found.push({ index, 0: window.slice(index), truncated: true });
+            found.sort((a, b) => a.index - b.index);
             for (const match of found) {
                 // Regex offsets count UTF-16 code units; scan columns count code points.
                 // Advance once through the window instead of recounting every prefix.
@@ -11048,26 +11972,238 @@ function collectHits(points, only) {
                 }
                 const start = offset + codePoint;
                 const key = `${kind}:${start}`;
+                const cutHere = match.truncated ?? (cut !== null && match.index + match[0].length === window.length &&
+                    continues(kind, window.slice(match.index), cut, regex));
                 const prior = hits.get(key);
-                if (!prior || match[0].length > prior.text.length)
-                    hits.set(key, { kind, start, text: match[0] });
+                if (prior && match[0].length <= prior.text.length)
+                    continue;
+                const hit = cutHere ? { kind, start, text: match[0], truncated: true } : { kind, start, text: match[0] };
+                hits.set(key, hit);
+                if (cutHere)
+                    truncated.set(key, hit);
+                else
+                    truncated.delete(key);
             }
         }
+        // This window reached the line end: a later one would only rescan its tail.
+        if (cut === null)
+            break;
+    }
+    return [...hits.values()].sort(byStartThenDetector);
+}
+/** The line's code points with every "\/" read as "/"; origin and escaped map back to the line. */
+function slashUnescaped(points) {
+    const out = [];
+    const origin = [];
+    const escaped = [];
+    for (let i = 0; i < points.length; i++) {
+        const pair = points[i] === '\\' && points[i + 1] === '/';
+        out.push(pair ? '/' : points[i]);
+        origin.push(i);
+        escaped.push(pair);
+        if (pair)
+            i++;
+    }
+    return { points: out, origin, escaped };
+}
+function byStartThenDetector(a, b) {
+    return a.start - b.start || detectors.findIndex(d => d.kind === a.kind) - detectors.findIndex(d => d.kind === b.kind);
+}
+// Punctuation that commonly follows a URI in text (markdown, prose, YAML flow, shell) but is
+// matched by the lndconnect pattern. It is removed only when the URI as matched does not parse.
+const TRAILING_PUNCTUATION = /[`)\]}>.,;:!?'"*]+$/;
+/** The credential an lndconnect match carries, and the match's length in code points once confirmed. */
+function lndconnectCredential(text) {
+    const bytes = (0, lndconnect_js_1.parseLndconnect)(text, { standardBase64: true });
+    if (bytes)
+        return { bytes, length: Array.from(text).length };
+    const trimmed = text.replace(TRAILING_PUNCTUATION, '');
+    if (trimmed === text)
+        return null;
+    const retried = (0, lndconnect_js_1.parseLndconnect)(trimmed, { standardBase64: true });
+    return retried ? { bytes: retried, length: Array.from(trimmed).length } : null;
+}
+/**
+ * The findings of one line (or of one decoded text, see scanEncoded). `column` maps a code
+ * point offset in `text` to the 1-based column reported.
+ */
+function scanLine(path, line, text, now, ctx, column) {
+    const findings = [];
+    let dropped = 0;
+    const points = Array.from(text);
+    let hits = collectHits(points);
+    // NWC URIs in common escaped forms (JSON-escaped slashes, percent-encoding, "+" as a
+    // space) are matched on one normalised copy of the line; a URI the line already matched
+    // at the same column is not reported twice (a whole match replaces one cut by a window).
+    const unescaped = (0, nwc_match_js_1.nwcUnescaped)(points, text);
+    if (unescaped) {
+        const seen = new Map(hits.filter(hit => hit.kind === 'nwc').map(hit => [hit.start, hit]));
+        const replaced = new Set();
+        for (const hit of collectHits(unescaped.points, ['nwc'])) {
+            const start = unescaped.origin[hit.start];
+            const prior = seen.get(start);
+            if (prior && !(prior.truncated && !hit.truncated))
+                continue;
+            if (prior)
+                replaced.add(prior);
+            const moved = { ...hit, start };
+            seen.set(start, moved);
+            hits.push(moved);
+        }
+        if (replaced.size)
+            hits = hits.filter(hit => !replaced.has(hit));
+        hits.sort((a, b) => a.start - b.start);
+    }
+    // JSON-escaped slashes ("\/", PHP json_encode by default and some Java and Go encoders) would
+    // stop a base64 macaroon or an lndconnect URI at the backslash: both are also matched on a
+    // copy of the line with "\/" read as "/". A match there replaces the one at the same column
+    // only when it covers more of the line, so an unescaped line yields the same hits.
+    const slashes = text.includes('\\/') ? slashUnescaped(points) : null;
+    if (slashes) {
+        const byKey = new Map(hits.map(hit => [`${hit.kind}:${hit.start}`, hit]));
+        const replaced = new Set();
+        for (const hit of collectHits(slashes.points, ['lndconnect', 'macaroon-base64'])) {
+            const start = slashes.origin[hit.start];
+            const last = hit.start + Array.from(hit.text).length - 1;
+            const extent = slashes.origin[last] + (slashes.escaped[last] ? 2 : 1) - start;
+            const key = `${hit.kind}:${start}`;
+            const prior = byKey.get(key);
+            if (prior && extent <= (prior.extent ?? Array.from(prior.text).length))
+                continue;
+            if (prior)
+                replaced.add(prior);
+            const moved = { ...hit, start, extent };
+            byKey.set(key, moved);
+            hits.push(moved);
+        }
+        if (replaced.size)
+            hits = hits.filter(hit => !replaced.has(hit));
+        hits.sort(byStartThenDetector);
+    }
+    // An lndconnect URI is confirmed first. Only a confirmed URI hides the matches inside it:
+    // a URI that does not parse never hides the credential it carries (fail closed).
+    const lineFindings = [];
+    const spans = [];
+    for (const hit of hits) {
+        if (hit.kind !== 'lndconnect' || hit.truncated)
+            continue;
+        const confirmed = lndconnectCredential(hit.text);
+        const facts = confirmed && decoded(confirmed.bytes);
+        if (!confirmed || !facts) {
+            dropped++;
+            continue;
+        }
+        const length = Array.from(hit.text).length;
+        spans.push({ start: hit.start, end: hit.start + (hit.extent ?? length) - (length - confirmed.length) });
+        lineFindings.push({ hit, finding: withFacts(path, line, column(hit.start), 'lndconnect', facts, now, ctx) });
     }
-    const all = [...hits.values()].sort((a, b) => a.start - b.start ||
-        detectors.findIndex(d => d.kind === a.kind) - detectors.findIndex(d => d.kind === b.kind));
-    const spans = all.filter(hit => hit.kind === 'lndconnect').map(hit => ({
-        start: hit.start, end: hit.start + Array.from(hit.text).length,
-    }));
     let spanIndex = 0;
     let coveredUntil = 0;
-    return all.filter(hit => {
+    for (const hit of hits) {
         while (spanIndex < spans.length && spans[spanIndex].start <= hit.start) {
             coveredUntil = Math.max(coveredUntil, spans[spanIndex].end);
             spanIndex++;
         }
-        return hit.kind === 'lndconnect' || hit.start >= coveredUntil;
-    });
+        const at = column(hit.start);
+        // A match cut by its window's end may continue past it: report it, never decode a part.
+        if (hit.truncated) {
+            lineFindings.push({ hit, finding: nullFinding(path, line, at, 'undecodable-candidate', fingerprint(hit.text)) });
+            continue;
+        }
+        if (hit.kind === 'lndconnect' || hit.start < coveredUntil)
+            continue;
+        if (hit.kind === 'nwc') {
+            // The matcher ends every match with secret=<64 hex> and at most one delimiter. Any
+            // match is reported (fail closed): "&amp;secret=" and other separators included.
+            const secret = /secret=([0-9a-f]{64})[^0-9a-f]?$/i.exec(hit.text)[1].toLowerCase();
+            ctx.secrets.add(secret);
+            lineFindings.push({ hit, finding: nullFinding(path, line, at, 'nwc', fingerprint(Buffer.from(secret, 'hex'))) });
+            continue;
+        }
+        const bytes = credentialBytes(hit);
+        const facts = bytes && decoded(bytes);
+        lineFindings.push({ hit, finding: facts ? withFacts(path, line, at, hit.kind, facts, now, ctx)
+                : nullFinding(path, line, at, 'undecodable-candidate', fingerprint(hit.text)) });
+    }
+    lineFindings.sort((a, b) => byStartThenDetector(a.hit, b.hit));
+    for (const { finding } of lineFindings)
+        findings.push(finding);
+    return { findings, dropped };
+}
+/**
+ * RR-02: credentials stored as the base64 of their text (Kubernetes Secret data, Helm values).
+ * Each base64 run of the line holding an encoded prefix is decoded once at each of the four
+ * character phases, and the decoded text is scanned as a line, one level deep: decoded text
+ * is never decoded again. A finding is reported at the column of its first encoded character.
+ */
+function scanEncoded(path, line, text, now, ctx) {
+    const findings = [];
+    const reported = new Set();
+    let dropped = 0;
+    const runs = /[A-Za-z0-9+/]{16,}={0,2}/g;
+    // Columns count code points; base64 is ASCII, so advance a code point counter once.
+    let unit = 0;
+    let point = 0;
+    for (let run = runs.exec(text); run; run = runs.exec(text)) {
+        while (unit < run.index) {
+            unit += text.codePointAt(unit) > 0xffff ? 2 : 1;
+            point++;
+        }
+        if (!ENCODED_CANDIDATE.test(run[0]))
+            continue;
+        const runStart = point;
+        for (let phase = 0; phase < 4 && phase < run[0].length; phase++) {
+            const usable = run[0].slice(phase).replace(/=+$/, '');
+            const decodedText = Buffer.from(usable.slice(0, usable.length - (usable.length % 4 === 1 ? 1 : 0)), 'base64').toString('latin1');
+            if (!PLAIN_MAY_MATCH.test(decodedText))
+                continue;
+            // Decoded byte b starts in encoded character floor(b * 4 / 3) of this phase.
+            const result = scanLine(path, line, decodedText, now, ctx, start => runStart + phase + Math.floor(start * 4 / 3) + 1);
+            dropped += result.dropped;
+            for (const finding of result.findings) {
+                const key = `${finding.column}:${finding.kind}:${finding.fingerprint}`;
+                if (!reported.has(key)) {
+                    reported.add(key);
+                    findings.push(finding);
+                }
+            }
+        }
+    }
+    return { findings, dropped };
+}
+/**
+ * RR-10: a credential wrapped narrower than 49 columns. When line `index` ends with a prefix
+ * too short for the published patterns, the following lines that hold only the same alphabet
+ * (indentation and trailing whitespace aside, at most CANDIDATE_LIMIT characters in all) are
+ * joined to it; the credential is reported only when the joined text decodes. Text after the
+ * credential is ignored, as the decoder ignores trailing bytes.
+ */
+function narrowWrap(path, lines, index, found, now, ctx) {
+    let last = index;
+    for (const { kind, start, more } of NARROW_WRAP) {
+        const tail = start.exec(lines[index]);
+        if (!tail)
+            continue;
+        const column = Array.from(lines[index].slice(0, tail.index)).length + 1;
+        if (found.some(finding => finding.column === column))
+            continue;
+        let joined = tail[0].trimEnd();
+        for (let next = index + 1; next < lines.length && joined.length < exports.CANDIDATE_LIMIT; next++) {
+            const part = lines[next].trim();
+            if (!more.test(part))
+                break;
+            joined += part;
+            last = Math.max(last, next);
+            if (part.endsWith('='))
+                break;
+        }
+        const bytes = kind === 'macaroon-hex' ? Buffer.from(joined.slice(0, joined.length - joined.length % 2), 'hex')
+            : Buffer.from(joined.slice(0, exports.CANDIDATE_LIMIT), joined.includes('-') || joined.includes('_') ? 'base64url' : 'base64');
+        const facts = decoded(bytes);
+        if (facts)
+            return { finding: withFacts(path, index + 1, column, kind, facts, now, ctx), last };
+    }
+    return { finding: null, last };
 }
 function scanText(path, text, now, ctx) {
     const findings = [];
@@ -11075,54 +12211,24 @@ function scanText(path, text, now, ctx) {
     if (!MAY_MATCH.test(text))
         return { findings, dropped };
     const lines = text.split(/\r\n|\n|\r/);
+    let joinedUntil = -1;
     for (let i = 0; i < lines.length; i++) {
         if (!MAY_MATCH.test(lines[i]))
             continue;
-        const points = Array.from(lines[i]);
-        const hits = collectHits(points);
-        // NWC URIs in common escaped forms (JSON-escaped slashes, percent-encoding, "+" as a
-        // space) are matched on one normalised copy of the line; a URI the line already matched
-        // at the same column is not reported twice.
-        const unescaped = (0, nwc_match_js_1.nwcUnescaped)(points, lines[i]);
-        if (unescaped) {
-            const seen = new Set(hits.filter(hit => hit.kind === 'nwc').map(hit => hit.start));
-            for (const hit of collectHits(unescaped.points, 'nwc')) {
-                const start = unescaped.origin[hit.start];
-                if (!seen.has(start)) {
-                    seen.add(start);
-                    hits.push({ ...hit, start });
-                }
-            }
-            hits.sort((a, b) => a.start - b.start);
-        }
-        for (const hit of hits) {
-            const column = hit.start + 1;
-            const line = i + 1;
-            if (hit.kind === 'nwc') {
-                // The matcher ends every match with secret=<64 hex> and at most one delimiter. Any
-                // match is reported (fail closed): "&amp;secret=" and other separators included.
-                const secret = /secret=([0-9a-f]{64})[^0-9a-f]?$/i.exec(hit.text)[1].toLowerCase();
-                ctx.secrets.add(secret);
-                findings.push(nullFinding(path, line, column, 'nwc', fingerprint(Buffer.from(secret, 'hex'))));
-                continue;
-            }
-            const bytes = credentialBytes(hit);
-            if (bytes) {
-                try {
-                    const facts = (0, index_js_1.decodeMacaroon)(new secret_js_1.Secret(bytes));
-                    findings.push(withFacts(path, line, column, hit.kind, facts, now, ctx));
-                    continue;
-                }
-                catch (error) {
-                    if (!(error instanceof index_js_1.DecodeError))
-                        throw error;
-                }
-            }
-            if (hit.kind === 'lndconnect')
-                dropped++;
-            else
-                findings.push(nullFinding(path, line, column, 'undecodable-candidate', fingerprint(hit.text)));
-        }
+        const line = scanLine(path, i + 1, lines[i], now, ctx, start => start + 1);
+        // Each line is joined into at most one wrap, so joining stays linear in the text.
+        if (i > joinedUntil) {
+            const wrapped = narrowWrap(path, lines, i, line.findings, now, ctx);
+            joinedUntil = wrapped.last;
+            if (wrapped.finding)
+                line.findings.push(wrapped.finding);
+        }
+        const encoded = ENCODED_CANDIDATE.test(lines[i]) ? scanEncoded(path, i + 1, lines[i], now, ctx) : null;
+        const lineFindings = encoded?.findings.length ? [...line.findings, ...encoded.findings].sort((a, b) => a.column - b.column)
+            : line.findings;
+        for (const finding of lineFindings)
+            findings.push(finding);
+        dropped += line.dropped + (encoded?.dropped ?? 0);
     }
     return { findings, dropped };
 }
@@ -11144,8 +12250,16 @@ function reportedPath(path) {
     const root = (0, node_path_1.parse)(path).root;
     const trailingSeparators = node_path_1.sep === '\\' ? /[\\/]+$/ : /\/+$/;
     const trimmed = path.length > root.length ? path.replace(trailingSeparators, '') : path;
-    return trimmed.replace(/\\/g, '/');
+    // Only Windows uses '\' as a separator; elsewhere it is an ordinary file name character.
+    return node_path_1.sep === '\\' ? trimmed.replace(/\\/g, '/') : trimmed;
 }
+// Windows and macOS file systems compare names case-insensitively by default, so '.GIT' there
+// is the '.git' directory. Elsewhere names are case-sensitive and '.GIT' is an ordinary directory.
+const CASE_INSENSITIVE_NAMES = process.platform === 'win32' || process.platform === 'darwin';
+function namedAs(name, names) {
+    return names.includes(CASE_INSENSITIVE_NAMES ? name.toLowerCase() : name);
+}
+const EXCLUDED_DIRS = ['.git', 'node_modules'];
 function isSystemDirectoryPath(path) {
     if (!path.startsWith('/'))
         return false;
@@ -11171,6 +12285,7 @@ class FindingsLimitError extends Error {
     }
 }
 exports.FindingsLimitError = FindingsLimitError;
+const NOT_SCANNABLE = 'scan path is not a regular file or directory';
 /** At most this many files are open and read at once during a directory walk. */
 exports.SCAN_CONCURRENCY = 16;
 /** Bound on dispatched but not yet committed file results (memory bound). */
@@ -11247,13 +12362,54 @@ function tagMcpContext(path, text, findings) {
             finding.context = 'mcp-config';
     }
 }
+/**
+ * Opens a file for scanning: read-only, no-follow where the platform has it, and non-blocking,
+ * so a FIFO swapped in after the walk's lstat cannot block open(2) waiting for a writer; the
+ * caller then fstats the descriptor and reads only a regular file.
+ */
+exports.SCAN_OPEN_FLAGS = node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NONBLOCK ?? 0) | (node_fs_1.constants.O_NOFOLLOW ?? 0);
+/**
+ * The scan's file system with every operation raced against the interrupt (SIGINT, SIGTERM,
+ * SIGHUP): an operation still pending when the scan is interrupted rejects with Cancelled at
+ * once, so a slow or stuck file system call cannot hold the scan. A handle opened after the
+ * interrupt is closed when its open completes; a close never waits for a stuck read.
+ */
+function cancellableFs(raw) {
+    const wrap = (operation) => (...args) => (0, cancellation_js_1.cancellable)(() => operation(...args));
+    const handle = (opened) => {
+        const close = () => { const closing = opened.close(); closing.catch(() => { }); return (0, cancellation_js_1.cancellable)(() => closing); };
+        // The scan uses only these three operations of a handle.
+        return { stat: wrap(opened.stat.bind(opened)), read: wrap(opened.read.bind(opened)),
+            close };
+    };
+    const open = async (...args) => {
+        (0, cancellation_js_1.checkCancellation)();
+        const pending = raw.open(...args);
+        try {
+            return handle(await (0, cancellation_js_1.cancellable)(() => pending));
+        }
+        catch (error) {
+            if (error instanceof cancellation_js_1.Cancelled)
+                pending.then(late => late.close()).catch(() => { });
+            throw error;
+        }
+    };
+    return { realpath: wrap(raw.realpath.bind(raw)),
+        lstat: wrap(raw.lstat.bind(raw)),
+        stat: wrap(raw.stat.bind(raw)),
+        readdir: wrap(raw.readdir.bind(raw)),
+        open };
+}
 async function scan(paths, opts = {}) {
-    const io = opts.fs ?? fs;
+    const io = cancellableFs(opts.fs ?? fs);
     const now = opts.clock?.() ?? new Date();
     const findings = [];
     const skipped = [];
     const skippedPaths = new Set();
     const scannedFiles = new Set();
+    // Files with findings by identity, with the index of the path argument that scanned them.
+    const owners = new Map();
+    let currentArg = -1;
     const secrets = new Set();
     const ctx = { secrets, facts: new Map() };
     let filesScanned = 0;
@@ -11270,7 +12426,7 @@ async function scan(paths, opts = {}) {
             const target = await io.realpath(path);
             if ((0, protected_path_js_1.isProtectedPath)(target) || isSystemDirectoryPath(target))
                 throw new index_js_3.InputError('input-read', 'cannot read ignore file');
-            const handle = await io.open(target, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+            const handle = await io.open(target, exports.SCAN_OPEN_FLAGS);
             let content;
             try {
                 const openedStat = await handle.stat({ bigint: true });
@@ -11284,7 +12440,9 @@ async function scan(paths, opts = {}) {
                 const bytes = await (0, bounded_file_js_1.readBounded)(handle, TEXT_LIMIT, openedStat.size);
                 if (bytes.length > TEXT_LIMIT)
                     throw new index_js_3.InputError('input-read', 'cannot read ignore file');
-                content = bytes.toString('utf8');
+                // Same encodings as scanned text: UTF-8 with or without BOM, UTF-16 LE or BE with a BOM
+                // (what Windows PowerShell 5.1 writes with '>' and Out-File).
+                content = decodeText(bytes);
             }
             finally {
                 await handle.close();
@@ -11294,7 +12452,7 @@ async function scan(paths, opts = {}) {
         catch (error) {
             if (optional && error.code === 'ENOENT')
                 return [];
-            if (error instanceof index_js_3.InputError || error instanceof ignore_js_1.IgnoreFileError)
+            if (error instanceof index_js_3.InputError || error instanceof ignore_js_1.IgnoreFileError || error instanceof cancellation_js_1.Cancelled)
                 throw error;
             throw new index_js_3.InputError('input-read', 'cannot read ignore file');
         }
@@ -11307,31 +12465,63 @@ async function scan(paths, opts = {}) {
             skipped.push({ path: safePath, reason });
         }
     };
-    async function scanFileTask(path, sourceStat, explicit) {
+    // True when `real` still names the directory the walk listed. lstat resolves every component
+    // of the path, so a component replaced by a symlink (whose own identity differs) or by any
+    // other directory since then shows up as a different identity. One lstat costs O(path
+    // length), never a resolution per component.
+    async function unchanged(parent) {
+        return sameFileIdentity(await io.lstat(parent.real, { bigint: true }), parent.stat);
+    }
+    /**
+     * Scans one file. An explicit argument is resolved with realpath. A walked file is not: its
+     * resolved path is its parent's resolved path joined with its name, because the walk never
+     * follows a symlink. Instead its own lstat, and its parent's identity, are checked again just
+     * before and after the open; only an entry that changed since the walk's lstat is resolved
+     * (realpath), to tell a swapped-in link to a protected file (never-open) from other changes.
+     */
+    async function scanFileTask(path, sourceStat, explicit, parent) {
         let identity;
         try {
-            const target = await io.realpath(path);
-            if ((0, protected_path_js_1.isProtectedPath)(target))
-                return { type: 'skip', path, reason: 'never-open' };
+            let target;
+            if (parent === undefined) {
+                target = await io.realpath(path);
+                if ((0, protected_path_js_1.isProtectedPath)(target))
+                    return { type: 'skip', path, reason: 'never-open' };
+            }
+            else {
+                target = (0, node_path_1.join)(parent.real, (0, node_path_1.basename)(path));
+                const current = await io.lstat(target, { bigint: true });
+                if (current.isSymbolicLink() || !current.isFile()) {
+                    if ((0, protected_path_js_1.isProtectedPath)(await io.realpath(target)))
+                        return { type: 'skip', path, reason: 'never-open' };
+                    return { type: 'skip', path, reason: current.isSymbolicLink() ? 'symlink' : 'not-regular' };
+                }
+                if (!await unchanged(parent))
+                    throw new index_js_3.InputError('input-read');
+            }
             const macaroonFile = /\.macaroon$/i.test((0, node_path_1.basename)(path));
             if (!macaroonFile && BigInt(sourceStat.size) > BigInt(TEXT_LIMIT))
                 return { type: 'skip', path, reason: 'size' };
             let handle;
             let bytes;
             try {
-                handle = await io.open(target, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+                handle = await io.open(target, exports.SCAN_OPEN_FLAGS);
                 const openedStat = await handle.stat({ bigint: true });
-                if (!openedStat.isFile())
+                if (!openedStat.isFile()) {
+                    if (explicit)
+                        return { type: 'error', error: new index_js_3.InputError('input-read', NOT_SCANNABLE) };
                     return { type: 'skip', path, reason: 'not-regular' };
-                // Check the resolved path again after open, including platforms without O_NOFOLLOW.
-                const openedPath = await io.realpath(target);
+                }
+                // Check the path again after open, including platforms without O_NOFOLLOW: it must
+                // still be the regular file that was opened, under the same resolved path.
                 const openedPathStat = await io.lstat(target, { bigint: true });
-                if ((0, protected_path_js_1.isProtectedPath)(openedPath) || openedPath !== target || !openedPathStat.isFile() ||
+                const samePath = parent === undefined ? await io.realpath(target).then(openedPath => !(0, protected_path_js_1.isProtectedPath)(openedPath) && openedPath === target) : await unchanged(parent);
+                if (!samePath || !openedPathStat.isFile() ||
                     openedPathStat.isSymbolicLink() || !sameFileIdentity(openedPathStat, openedStat))
                     throw new index_js_3.InputError('input-read');
                 identity = fileIdentity(openedStat, target);
                 if (scannedFiles.has(identity))
-                    return { type: 'dup' };
+                    return { type: 'dup', path, identity };
                 bytes = await (0, bounded_file_js_1.readBounded)(handle, macaroonFile ? MACAROON_LIMIT : TEXT_LIMIT, openedStat.size);
             }
             finally {
@@ -11346,9 +12536,11 @@ async function scan(paths, opts = {}) {
                 for (const finding of outcome.findings)
                     finding.path = safePath;
             }
-            return { type: 'file', identity, findings: outcome.findings, dropped: outcome.dropped };
+            return { type: 'file', path, identity, findings: outcome.findings, dropped: outcome.dropped };
         }
-        catch {
+        catch (error) {
+            if (error instanceof cancellation_js_1.Cancelled)
+                throw error;
             if (explicit)
                 return { type: 'error', error: new index_js_3.InputError('input-read', 'cannot read scan path') };
             return { type: 'skip', path, reason: 'unreadable', identity };
@@ -11359,15 +12551,34 @@ async function scan(paths, opts = {}) {
             throw new FindingsLimitError();
         findings.push(finding);
     }
+    // Another name of a file already scanned under the same path argument (a hard link) is
+    // added to the alsoAt of that file's findings, so every path holding the credential is
+    // reported. Names reached through a different argument stay silent (SPEC: several arguments).
+    function alias(identity, path) {
+        const owner = owners.get(identity);
+        if (!owner || owner.arg !== currentArg)
+            return;
+        const safePath = (0, redact_js_1.redactPath)(reportedPath(path));
+        for (const finding of owner.findings) {
+            const also = finding.alsoAt ??= { count: 0, paths: [] };
+            also.count++;
+            if (also.paths.length < exports.ALSO_AT_EXAMPLES)
+                also.paths.push(safePath);
+        }
+    }
     // Applies one event. A file whose identity was already committed is a
     // duplicate, exactly as the sequential walk's check before reading.
     function commit(event) {
         if (event.type === 'error')
             throw event.error;
-        if (event.type === 'dup')
+        if (event.type === 'dup') {
+            alias(event.identity, event.path);
             return;
-        if (event.identity !== undefined && scannedFiles.has(event.identity))
+        }
+        if (event.identity !== undefined && scannedFiles.has(event.identity)) {
+            alias(event.identity, event.path);
             return;
+        }
         if (event.type === 'skip') {
             skip(event.path, event.reason);
             return;
@@ -11377,6 +12588,8 @@ async function scan(paths, opts = {}) {
         dropped += event.dropped;
         filesScanned++;
         scannedFiles.add(event.identity);
+        if (event.findings.length)
+            owners.set(event.identity, { arg: currentArg, findings: event.findings });
     }
     // Ordered, bounded dispatch: at most SCAN_CONCURRENCY file tasks run, and at
     // most SCAN_QUEUE results wait for earlier ones before being committed.
@@ -11405,12 +12618,12 @@ async function scan(paths, opts = {}) {
         ready.set(dispatched++, event);
         drainReady();
     }
-    async function dispatch(path, stat) {
+    async function dispatch(path, stat, parent) {
         (0, cancellation_js_1.checkCancellation)();
         await waitFor(() => running < exports.SCAN_CONCURRENCY && dispatched - committed < SCAN_QUEUE);
         const sequence = dispatched++;
         running++;
-        void scanFileTask(path, stat, false)
+        void scanFileTask(path, stat, false, parent)
             .catch((error) => ({ type: 'error', error }))
             .then(event => { running--; ready.set(sequence, event); signal(); });
     }
@@ -11422,7 +12635,13 @@ async function scan(paths, opts = {}) {
         await settle();
         commit(await scanFileTask(path, sourceStat, explicit));
     }
-    async function walk(path, isRoot, rootStat, known) {
+    // An interrupt ends the scan; it is never turned into an unreadable skip or exit 3.
+    const rethrowCancelled = (error) => { if (error instanceof cancellation_js_1.Cancelled)
+        throw error; };
+    // `parent` is the walked directory that listed `path` (absent for a path argument). Resolved
+    // paths are carried down the walk instead of calling realpath per entry: realpath resolves
+    // every component, so per entry it made the walk's cost grow with the cube of its depth.
+    async function walk(path, isRoot, rootStat, known, parent, rootReal) {
         (0, cancellation_js_1.checkCancellation)();
         const note = (target, reason) => emit({ type: 'skip', path: target, reason });
         if ((0, protected_path_js_1.isProtectedPath)(path)) {
@@ -11441,7 +12660,8 @@ async function scan(paths, opts = {}) {
             try {
                 entry = await io.lstat(path, { bigint: true });
             }
-            catch {
+            catch (error) {
+                rethrowCancelled(error);
                 if (isRoot)
                     throw new index_js_3.InputError('input-read', 'cannot read scan path');
                 await note(path, 'unreadable');
@@ -11455,14 +12675,23 @@ async function scan(paths, opts = {}) {
         const stat = rootStat ?? entry;
         if (stat.isDirectory()) {
             let target;
-            try {
-                target = await io.realpath(path);
+            if (rootReal !== undefined)
+                target = rootReal;
+            else if (parent === undefined) {
+                try {
+                    target = await io.realpath(path);
+                }
+                catch (error) {
+                    rethrowCancelled(error);
+                    if (isRoot)
+                        throw new index_js_3.InputError('input-read', 'cannot read scan path');
+                    await note(path, 'unreadable');
+                    return;
+                }
             }
-            catch {
-                if (isRoot)
-                    throw new index_js_3.InputError('input-read', 'cannot read scan path');
-                await note(path, 'unreadable');
-                return;
+            else {
+                // Not a symlink (refused above), so it resolves to its parent's resolved path plus its name.
+                target = (0, node_path_1.join)(parent.real, (0, node_path_1.basename)(path));
             }
             if ((0, protected_path_js_1.isProtectedPath)(target)) {
                 await note(path, 'never-open');
@@ -11472,8 +12701,7 @@ async function scan(paths, opts = {}) {
                 await note(path, 'excluded-dir');
                 return;
             }
-            const name = (0, node_path_1.basename)(path).toLowerCase();
-            if (!opts.includeDirs && (name === '.git' || name === 'node_modules')) {
+            if (!opts.includeDirs && namedAs((0, node_path_1.basename)(path), EXCLUDED_DIRS)) {
                 await note(path, 'excluded-dir');
                 return;
             }
@@ -11481,43 +12709,62 @@ async function scan(paths, opts = {}) {
             try {
                 names = await io.readdir(path);
             }
-            catch {
+            catch (error) {
+                rethrowCancelled(error);
                 if (isRoot)
                     throw new index_js_3.InputError('input-read', 'cannot read scan path');
                 await note(path, 'unreadable');
                 return;
             }
             const rootListing = isRoot && reportedPath(path) === '/';
+            const self = { real: target, stat };
             // Stat children in bounded batches, then visit them in listing order.
             // Protected and excluded names are never stat'ed, as before.
             for (let offset = 0; offset < names.length; offset += exports.SCAN_CONCURRENCY) {
                 const batch = names.slice(offset, offset + exports.SCAN_CONCURRENCY).map(child => (0, node_path_1.join)(path, child));
                 const entries = await Promise.all(batch.map(async (child) => {
-                    if (rootListing && ['proc', 'sys', 'dev'].includes((0, node_path_1.basename)(child).toLowerCase()))
+                    if (rootListing && namedAs((0, node_path_1.basename)(child), ['proc', 'sys', 'dev']))
                         return { excluded: true };
                     if ((0, protected_path_js_1.isProtectedPath)(child))
                         return { protected: true };
                     try {
                         return { stat: await io.lstat(child, { bigint: true }) };
                     }
-                    catch {
+                    catch (error) {
+                        rethrowCancelled(error);
                         return { error: true };
                     }
                 }));
+                // The children's stats count only if this directory is still the one listed: a path
+                // component swapped for a symlink would otherwise lead the walk outside the tree.
+                let same;
+                try {
+                    same = await unchanged(self);
+                }
+                catch (error) {
+                    rethrowCancelled(error);
+                    same = false;
+                }
+                if (!same) {
+                    if (isRoot)
+                        throw new index_js_3.InputError('input-read', 'cannot read scan path');
+                    await note(path, 'unreadable');
+                    return;
+                }
                 for (let i = 0; i < batch.length; i++) {
                     const known = entries[i];
                     if ('excluded' in known)
                         await note(batch[i], 'excluded-dir');
                     else
-                        await walk(batch[i], false, undefined, known);
+                        await walk(batch[i], false, undefined, known, self);
                 }
             }
         }
         else if (stat.isFile()) {
-            if (isRoot)
+            if (isRoot || parent === undefined)
                 await scanFile(path, stat, true);
             else
-                await dispatch(path, stat);
+                await dispatch(path, stat, parent);
         }
         else {
             await note(path, 'not-regular');
@@ -11546,7 +12793,9 @@ async function scan(paths, opts = {}) {
             shallowHistory = true;
         }
         // A credential still present in the work tree is already reported by the walk.
-        const workTree = new Set(findings.map(finding => `${finding.path}\0${finding.fingerprint}`));
+        // That includes a work-tree file's other hard-link names (its alsoAt).
+        const workTree = new Set(findings.flatMap(finding => [finding.path, ...(finding.commit === undefined ? finding.alsoAt?.paths ?? [] : [])]
+            .map(path => `${path}\0${finding.fingerprint}`)));
         const table = await (0, git_history_js_1.historyEntries)(git, directory, repository, pathspec);
         // Per distinct path: CLASSIFIED, MACAROON (*.macaroon), EXCLUDED (protected or in an
         // excluded directory), and whether a skip was already reported for it (skips are
@@ -11565,8 +12814,8 @@ async function scan(paths, opts = {}) {
                 pathState[p] |= CLASSIFIED;
                 const relativePath = table.paths[p];
                 const parents = relativePath.split('/').slice(0, -1);
-                // Same comparison as the file walk (case-insensitive), so history and work tree agree.
-                const excluded = parents.findIndex(segment => ['.git', 'node_modules'].includes(segment.toLowerCase()));
+                // Same comparison as the file walk, so history and work tree agree.
+                const excluded = parents.findIndex(segment => namedAs(segment, EXCLUDED_DIRS));
                 if ((0, protected_path_js_1.isProtectedPath)(joined(p))) {
                     skip(joined(p), 'never-open');
                     pathState[p] |= EXCLUDED;
@@ -11726,13 +12975,15 @@ async function scan(paths, opts = {}) {
         }
     }
     for (const arg of paths) {
+        currentArg++;
         if ((0, protected_path_js_1.isProtectedPath)(arg)) {
             skip(arg, 'never-open');
             continue;
         }
         let stat;
+        let target;
         try {
-            const target = await io.realpath(arg);
+            target = await io.realpath(arg);
             if ((0, protected_path_js_1.isProtectedPath)(target)) {
                 skip(arg, 'never-open');
                 continue;
@@ -11743,12 +12994,19 @@ async function scan(paths, opts = {}) {
             }
             stat = await io.stat(arg, { bigint: true });
         }
-        catch {
+        catch (error) {
+            if (error instanceof cancellation_js_1.Cancelled)
+                throw error;
             throw new index_js_3.InputError('input-read', 'cannot read scan path');
         }
+        // A named FIFO, device or socket cannot be scanned. Skipping it would let a CI gate pass
+        // having scanned nothing, so it fails like an unreadable path.
+        if (!stat.isFile() && !stat.isDirectory())
+            throw new index_js_3.InputError('input-read', NOT_SCANNABLE);
         const entries = explicitIgnore ?? (stat.isDirectory() ? await readIgnoreFile((0, node_path_1.join)(arg, '.macwardenignore'), true) : []);
         const firstFinding = findings.length;
-        await walk(arg, true, stat);
+        // The argument was resolved above; the walk starts from that resolved path.
+        await walk(arg, true, stat, undefined, undefined, target);
         await settle();
         if (opts.gitHistory)
             await scanHistory(arg, stat);
@@ -11770,7 +13028,7 @@ async function scan(paths, opts = {}) {
                 let drop = false;
                 if (candidates) {
                     const ignoredAt = (path) => {
-                        const matchPath = explicitIgnore === null ? (0, node_path_1.relative)(arg, path).replace(/\\/g, '/') : path;
+                        const matchPath = explicitIgnore === null ? (0, node_path_1.relative)(arg, path).split(node_path_1.sep).join('/') : path;
                         const key = `${finding.fingerprint}\0${matchPath}`;
                         const known = decided.get(key);
                         const result = known ?? candidates.some(entry => entry.matches(matchPath));
@@ -12045,7 +13303,12 @@ const PREFIX = /(?:nostr\+walletconnect|nostrwalletconnect):(?:\/\/)?[0-9a-f]{64
 const BOUNDARY = /[\s"'<>]/;
 const HEX = /[0-9a-f]/i;
 const SECRET = 'secret=';
-function nwcMatches(text) {
+/**
+ * `open`, when given and empty, receives the index of the first prefix (outside an earlier
+ * match) whose middle runs to the end of `text` without a boundary or a valid secret: in a
+ * window cut from a longer line, such a URI may continue past the window end.
+ */
+function nwcMatches(text, open) {
     const length = text.length;
     // nextValid[i]: smallest p >= i where "secret=" + 64 hex + (non-hex | end) starts.
     // nextBoundary[i]: smallest p >= i holding a boundary character. Both scanned right to left.
@@ -12074,6 +13337,9 @@ function nwcMatches(text) {
         const middle = head.index + head[0].length;
         const secretAt = nextValid[middle];
         const boundaryAt = nextBoundary[middle];
+        // Every later prefix lies in the same open run, so only the first is reported.
+        if (secretAt === -1 && boundaryAt === -1 && open?.length === 0)
+            open.push(head.index);
         if (secretAt === -1 || (boundaryAt !== -1 && boundaryAt < secretAt))
             continue;
         const afterHex = secretAt + SECRET.length + 64;
@@ -13081,6 +14347,8 @@ const nodeFs = __importStar(require("node:fs/promises"));
 const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
 const bounded_file_js_1 = require("../bounded-file.js");
+const instant_js_1 = require("../instant.js");
+const root_key_id_js_1 = require("../root-key-id.js");
 // Callers choose how many distinct (credential, method) pairs exist, so the store is
 // bounded. At capacity the least recently seen record is evicted (O(1): the Map keeps
 // records in recency order), and the eviction is remembered so `recommend` can tell
@@ -13113,9 +14381,12 @@ class UsageFileError extends Error {
 }
 exports.UsageFileError = UsageFileError;
 const fields = ['nodePubkey', 'credential', 'rootKeyId', 'method', 'calls', 'errors', 'firstSeen', 'lastSeen'];
-const time = /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/;
+// Timestamps must be real instants (isInstant) and each pair in order, compared as instants:
+// evidence with an impossible or reversed time is refused, never used for time arithmetic.
+const ordered = (first, last) => (0, instant_js_1.isInstant)(first) && (0, instant_js_1.isInstant)(last) && Date.parse(first) <= Date.parse(last);
+/** The later of two instants (a clock stepping back never moves a "last" time before its "first"). */
+const later = (current, now) => Date.parse(now) >= Date.parse(current) ? now : current;
 const NODE = /^0[23][0-9a-f]{64}$/;
-const ROOT = /^(0|[1-9][0-9]{0,19})$/;
 const exactKeys = (record, names) => {
     const keys = Object.keys(record);
     return keys.length === names.length && keys.every(key => names.includes(key));
@@ -13125,15 +14396,13 @@ const object = (value) => !!value && typeof value === 'object' && !Array.isArray
 function validCanaryUse(value) {
     return object(value) && exactKeys(value, ['nodePubkey', 'rootKeyId', 'uses', 'firstUse', 'lastUse'])
         && typeof value.nodePubkey === 'string' && NODE.test(value.nodePubkey)
-        && typeof value.rootKeyId === 'string' && ROOT.test(value.rootKeyId)
-        && count(value.uses) && typeof value.firstUse === 'string' && time.test(value.firstUse)
-        && typeof value.lastUse === 'string' && time.test(value.lastUse);
+        && (0, root_key_id_js_1.isRootKeyId)(value.rootKeyId)
+        && count(value.uses) && ordered(value.firstUse, value.lastUse);
 }
 function validCoverage(value) {
     return object(value) && exactKeys(value, ['nodePubkey', 'firstStart', 'lastEnd', 'coveredSeconds', 'sessions'])
         && typeof value.nodePubkey === 'string' && NODE.test(value.nodePubkey)
-        && typeof value.firstStart === 'string' && time.test(value.firstStart)
-        && typeof value.lastEnd === 'string' && time.test(value.lastEnd)
+        && ordered(value.firstStart, value.lastEnd)
         && count(value.coveredSeconds) && count(value.sessions);
 }
 function validSpans(value) {
@@ -13141,7 +14410,7 @@ function validSpans(value) {
         && typeof value.nodePubkey === 'string' && NODE.test(value.nodePubkey)
         && Array.isArray(value.spans) && value.spans.length <= exports.SPAN_LIMIT
         && value.spans.every(span => Array.isArray(span) && span.length === 2
-            && span.every(at => typeof at === 'string' && time.test(at)) && Date.parse(span[0]) <= Date.parse(span[1]));
+            && ordered(span[0], span[1]));
 }
 /** The union of spans: overlapping or touching ones merged, so no time is counted twice. */
 function union(spans) {
@@ -13163,12 +14432,11 @@ function validRecord(value) {
     return keys.length === fields.length && keys.every(key => fields.includes(key))
         && typeof record.nodePubkey === 'string' && /^0[23][0-9a-f]{64}$/.test(record.nodePubkey)
         && typeof record.credential === 'string' && /^id:[0-9a-f]{16}$/.test(record.credential)
-        && typeof record.rootKeyId === 'string' && /^(0|[1-9][0-9]{0,19})$/.test(record.rootKeyId)
+        && (0, root_key_id_js_1.isRootKeyId)(record.rootKeyId)
         && typeof record.method === 'string' && /^\/[A-Za-z0-9_.]+\/[A-Za-z0-9_]+$/.test(record.method)
         && Number.isSafeInteger(record.calls) && record.calls >= 0
         && Number.isSafeInteger(record.errors) && record.errors >= 0
-        && typeof record.firstSeen === 'string' && time.test(record.firstSeen)
-        && typeof record.lastSeen === 'string' && time.test(record.lastSeen);
+        && ordered(record.firstSeen, record.lastSeen);
 }
 class UsageStore {
     limit;
@@ -13201,7 +14469,7 @@ class UsageStore {
     touch() { this.changed = true; this.version += 1; }
     /** Counts denied uses of a registered canary. */
     recordCanary(nodePubkey, rootKeyId, uses, at) {
-        if (!NODE.test(nodePubkey) || !ROOT.test(rootKeyId) || !Number.isSafeInteger(uses) || uses < 1)
+        if (!NODE.test(nodePubkey) || !(0, root_key_id_js_1.isRootKeyId)(rootKeyId) || !Number.isSafeInteger(uses) || uses < 1)
             return;
         const key = `${nodePubkey}\0${rootKeyId}`;
         const now = at.toISOString();
@@ -13210,7 +14478,7 @@ class UsageStore {
         if (!existing && this.canaryUses.size >= exports.CANARY_LIMIT)
             this.canaryUses.delete(this.canaryUses.keys().next().value);
         this.canaryUses.set(key, existing
-            ? { ...existing, uses: Math.min(existing.uses + uses, Number.MAX_SAFE_INTEGER), lastUse: now }
+            ? { ...existing, uses: Math.min(existing.uses + uses, Number.MAX_SAFE_INTEGER), lastUse: later(existing.lastUse, now) }
             : { nodePubkey, rootKeyId, uses, firstUse: now, lastUse: now });
         this.touch();
     }
@@ -13230,7 +14498,7 @@ class UsageStore {
             this.coverages.delete(oldest);
             this.spans.delete(oldest);
         }
-        this.coverages.set(nodePubkey, existing ? { ...existing, sessions: existing.sessions + 1, lastEnd: now }
+        this.coverages.set(nodePubkey, existing ? { ...existing, sessions: existing.sessions + 1, lastEnd: later(existing.lastEnd, now) }
             : { nodePubkey, firstStart: now, lastEnd: now, coveredSeconds: 0, sessions: 1 });
         this.covering.set(nodePubkey, at.getTime());
         // A new span, starting no earlier than the last one ended (a clock stepping back never
@@ -13264,7 +14532,7 @@ class UsageStore {
         const span = this.spans.get(nodePubkey)?.at(-1);
         if (span && until > span[1])
             span[1] = until;
-        record.lastEnd = at.toISOString();
+        record.lastEnd = later(record.lastEnd, at.toISOString());
         this.touch();
     }
     /** The registration ended (stream lost, run stopped). */
@@ -13301,7 +14569,7 @@ class UsageStore {
      */
     record(nodePubkey, credential, rootKeyId, method, at, error = false) {
         if (!/^0[23][0-9a-f]{64}$/.test(nodePubkey) || !/^id:[0-9a-f]{16}$/.test(credential)
-            || !/^(0|[1-9][0-9]{0,19})$/.test(rootKeyId) || BigInt(rootKeyId) > 18446744073709551615n) {
+            || !(0, root_key_id_js_1.isRootKeyId)(rootKeyId)) {
             this.refused += 1;
             return false;
         }
@@ -13314,7 +14582,7 @@ class UsageStore {
                 existing.errors += 1;
             else
                 existing.calls += 1;
-            existing.lastSeen = now;
+            existing.lastSeen = later(existing.lastSeen, now);
             // Move to the end: the first record in the Map is always the least recently seen.
             this.records.delete(key);
             this.records.set(key, existing);
@@ -13388,7 +14656,7 @@ class UsageStore {
         // are required; known later fields are validated when present; unknown fields are
         // ignored, so a newer file stays readable by this version.
         const count = (field) => field === undefined || (Number.isSafeInteger(field) && field >= 0);
-        const instant = (field) => field === undefined || field === null || (typeof field === 'string' && time.test(field));
+        const instant = (field) => field === undefined || field === null || (0, instant_js_1.isInstant)(field);
         if (value.schema !== 1 || !Number.isSafeInteger(value.dropped) || value.dropped < 0
             || !count(value.evictions) || !instant(value.lastEviction)
             || !count(value.droppedAttributions) || !instant(value.lastAttributionDrop)
@@ -14018,7 +15286,7 @@ function load(id) { if (id === 'grade/lnd-permissions.json') return snapshot; if
         } return load(parts.join('/')); }); return module.exports; }
 export const api0_readBounded = load("bounded-file.js").readBounded;
 export const api0_readBoundedFile = load("bounded-file.js").readBoundedFile;
-export const api0_assertPlainFile = load("bounded-file.js").assertPlainFile;
+export const api0_readPlainFile = load("bounded-file.js").readPlainFile;
 export const api0_BoundedFileError = load("bounded-file.js").BoundedFileError;
 export const api0_DEFAULT_FILE_LIMIT = load("bounded-file.js").DEFAULT_FILE_LIMIT;
 export const api0_LOCK_FILE_LIMIT = load("bounded-file.js").LOCK_FILE_LIMIT;
@@ -14040,235 +15308,254 @@ export const api5_attenuate = load("commands/attenuate.js").attenuate;
 export const api6_allocateRootKeyId = load("commands/bake/allocate.js").allocateRootKeyId;
 export const api7_run = load("commands/bake/index.js").run;
 export const api7_bake = load("commands/bake/index.js").bake;
-export const api8_reserveOut = load("commands/bake/write-out.js").reserveOut;
-export const api9_handlers = load("commands/handlers.js").handlers;
-export const api10_inspectResult = load("commands/inspect.js").inspectResult;
-export const api10_run = load("commands/inspect.js").run;
-export const api10_inspect = load("commands/inspect.js").inspect;
-export const api11_run = load("commands/inventory.js").run;
-export const api11_inventory = load("commands/inventory.js").inventory;
-export const api12_narrowLabel = load("commands/recommend.js").narrowLabel;
-export const api12_run = load("commands/recommend.js").run;
-export const api12_recommend = load("commands/recommend.js").recommend;
-export const api12_SHORT_OBSERVATION_SECONDS = load("commands/recommend.js").SHORT_OBSERVATION_SECONDS;
-export const api13_aggregateExit = load("commands/respond.js").aggregateExit;
-export const api13_run = load("commands/respond.js").run;
-export const api13_respond = load("commands/respond.js").respond;
-export const api13_ROOT_KEY_0_GUIDANCE = load("commands/respond.js").ROOT_KEY_0_GUIDANCE;
-export const api13_OWN_ON_ROOT_KEY_0 = load("commands/respond.js").OWN_ON_ROOT_KEY_0;
-export const api13_REVOKED_BUT_PRESENT_GUIDANCE = load("commands/respond.js").REVOKED_BUT_PRESENT_GUIDANCE;
-export const api13_BAKING_RISK_GUIDANCE = load("commands/respond.js").BAKING_RISK_GUIDANCE;
-export const api13_CUSTOM_CAVEAT_NOTE = load("commands/respond.js").CUSTOM_CAVEAT_NOTE;
-export const api13_UNKNOWN_GUIDANCE = load("commands/respond.js").UNKNOWN_GUIDANCE;
-export const api14_run = load("commands/revoke.js").run;
-export const api14_revoke = load("commands/revoke.js").revoke;
-export const api15_run = load("commands/rotate.js").run;
-export const api15_rotate = load("commands/rotate.js").rotate;
-export const api16_run = load("commands/scan.js").run;
-export const api17_run = load("commands/verify.js").run;
-export const api17_verify = load("commands/verify.js").verify;
-export const api17_ROOT_KEY_0_ACCEPTED = load("commands/verify.js").ROOT_KEY_0_ACCEPTED;
-export const api17_CAN_BAKE_ACCEPTED = load("commands/verify.js").CAN_BAKE_ACCEPTED;
-export const api17_CAN_BAKE_ROOT_KEY_0 = load("commands/verify.js").CAN_BAKE_ROOT_KEY_0;
-export const api17_OWN_ROOT_KEY_ACCEPTED = load("commands/verify.js").OWN_ROOT_KEY_ACCEPTED;
-export const api17_REJECTED_INCONCLUSIVE = load("commands/verify.js").REJECTED_INCONCLUSIVE;
-export const api17_CUSTOM_CAVEAT_REJECTED = load("commands/verify.js").CUSTOM_CAVEAT_REJECTED;
-export const api18_scheduleDeadline = load("commands/watch.js").scheduleDeadline;
-export const api18_lockOwnerGone = load("commands/watch.js").lockOwnerGone;
-export const api18_acquireLock = load("commands/watch.js").acquireLock;
-export const api18_run = load("commands/watch.js").run;
-export const api18_stdoutEvents = load("commands/watch.js").stdoutEvents;
-export const api18_watch = load("commands/watch.js").watch;
-export const api18_CANARY_RELOAD_MS = load("commands/watch.js").CANARY_RELOAD_MS;
-export const api18_MAX_TIMER_MS = load("commands/watch.js").MAX_TIMER_MS;
-export const api19_redactEncodedCredentials = load("credential-recognition.js").redactEncodedCredentials;
-export const api20_macaroonEosEnd = load("decode/index.js").macaroonEosEnd;
-export const api20_macaroonPacketRange = load("decode/index.js").macaroonPacketRange;
-export const api20_macaroonSectionRange = load("decode/index.js").macaroonSectionRange;
-export const api20_parseTimeBefore = load("decode/index.js").parseTimeBefore;
-export const api20_canonicalMacaroonForm = load("decode/index.js").canonicalMacaroonForm;
-export const api20_decodeMacaroon = load("decode/index.js").decodeMacaroon;
-export const api20_macaroonId = load("decode/index.js").macaroonId;
-export const api20_encodeMacaroon = load("decode/index.js").encodeMacaroon;
-export const api20_addFirstPartyCaveat = load("decode/index.js").addFirstPartyCaveat;
-export const api20_timeBeforeCondition = load("decode/index.js").timeBeforeCondition;
-export const api20_validMacaroonIdentifier = load("decode/index.js").validMacaroonIdentifier;
-export const api20_isNwcContainer = load("decode/index.js").isNwcContainer;
-export const api20_decodeNwc = load("decode/index.js").decodeNwc;
-export const api20_DecodeError = load("decode/index.js").DecodeError;
-export const api21_macaroonEnds = load("decode/recognition.js").macaroonEnds;
-export const api22_unsafeNodeDiagnostics = load("environment.js").unsafeNodeDiagnostics;
-export const api23_UsageError = load("errors.js").UsageError;
-export const api23_InputError = load("errors.js").InputError;
-export const api23_DecodeError = load("errors.js").DecodeError;
-export const api23_LndError = load("errors.js").LndError;
-export const api23_LndUncertainError = load("errors.js").LndUncertainError;
-export const api24_grade = load("grade/index.js").grade;
-export const api24_gradeFacts = load("grade/index.js").gradeFacts;
-export const api24_describe = load("grade/index.js").describe;
-export const api25_groupedRuns = load("grouped-runs.js").groupedRuns;
-export const api25_groupedBase64 = load("grouped-runs.js").groupedBase64;
-export const api26_readCredential = load("input/index.js").readCredential;
-export const api26_InputError = load("input/index.js").InputError;
-export const api26_UsageError = load("input/index.js").UsageError;
-export const api27_parseLndconnect = load("input/lndconnect.js").parseLndconnect;
-export const api28_openGrpcStream = load("lnd/grpc.js").openGrpcStream;
-export const api28_MAX_GRPC_MESSAGE = load("lnd/grpc.js").MAX_GRPC_MESSAGE;
-export const api28_STALL_TIMEOUT_MS = load("lnd/grpc.js").STALL_TIMEOUT_MS;
-export const api28_MAX_PENDING_WRITE_BYTES = load("lnd/grpc.js").MAX_PENDING_WRITE_BYTES;
-export const api28_WRITE_OVERHEAD_BYTES = load("lnd/grpc.js").WRITE_OVERHEAD_BYTES;
-export const api28_PING_INTERVAL_MS = load("lnd/grpc.js").PING_INTERVAL_MS;
-export const api28_PING_TIMEOUT_MS = load("lnd/grpc.js").PING_TIMEOUT_MS;
-export const api29_createLndAdapter = load("lnd/index.js").createLndAdapter;
-export const api29_registerMiddleware = load("lnd/index.js").registerMiddleware;
-export const api30_decodeMiddlewareRequest = load("lnd/middleware-proto.js").decodeMiddlewareRequest;
-export const api30_encodeRegistration = load("lnd/middleware-proto.js").encodeRegistration;
-export const api30_encodeFeedback = load("lnd/middleware-proto.js").encodeFeedback;
-export const api30_MAX_MACAROON_BYTES = load("lnd/middleware-proto.js").MAX_MACAROON_BYTES;
-export const api30_MAX_METHOD_BYTES = load("lnd/middleware-proto.js").MAX_METHOD_BYTES;
-export const api30_MAX_CONDITION_BYTES = load("lnd/middleware-proto.js").MAX_CONDITION_BYTES;
-export const api30_UNKNOWN_METHOD = load("lnd/middleware-proto.js").UNKNOWN_METHOD;
-export const api31_identityCheck = load("lnd/tls-identity.js").identityCheck;
-export const api32_endpoint = load("online.js").endpoint;
-export const api32_credentialText = load("online.js").credentialText;
-export const api32_connectionProblem = load("online.js").connectionProblem;
-export const api32_flagProblem = load("online.js").flagProblem;
-export const api32_nodeInfo = load("online.js").nodeInfo;
-export const api32_nodePubkey = load("online.js").nodePubkey;
-export const api32_drift = load("online.js").drift;
-export const api32_samePermissions = load("online.js").samePermissions;
-export const api32_listIds = load("online.js").listIds;
-export const api32_failureDetails = load("online.js").failureDetails;
-export const api32_onlineAdapter = load("online.js").onlineAdapter;
-export const api32_shellQuote = load("online.js").shellQuote;
-export const api32_recoveryPath = load("online.js").recoveryPath;
-export const api32_recoveryCommand = load("online.js").recoveryCommand;
-export const api32_inventoryRecoveryCommand = load("online.js").inventoryRecoveryCommand;
-export const api32_readOnlineCredential = load("online.js").readOnlineCredential;
-export const api32_onlineWarnings = load("online.js").onlineWarnings;
-export const api32_LABEL_RULE = load("online.js").LABEL_RULE;
-export const api32_readBoundedFile = load("online.js").readBoundedFile;
-export const api33_rotatePlanResult = load("output/index.js").rotatePlanResult;
-export const api33_revokePlanResult = load("output/index.js").revokePlanResult;
-export const api33_error = load("output/index.js").error;
-export const api33_warning = load("output/index.js").warning;
-export const api33_renderWatchEvent = load("output/index.js").renderWatchEvent;
-export const api33_formatDuration = load("output/index.js").formatDuration;
-export const api33_revokeConfirmation = load("output/index.js").revokeConfirmation;
-export const api33_writeRevokePrompt = load("output/index.js").writeRevokePrompt;
-export const api33_writeRotateFinishPlan = load("output/index.js").writeRotateFinishPlan;
-export const api33_rotateConfirmation = load("output/index.js").rotateConfirmation;
-export const api33_writeRotatePrompt = load("output/index.js").writeRotatePrompt;
-export const api33_render = load("output/index.js").render;
-export const api33_renderChunks = load("output/index.js").renderChunks;
-export const api33_inventoryResult = load("output/index.js").inventoryResult;
-export const api33_writeRotateStagePlan = load("output/index.js").writeRotateStagePlan;
-export const api34_ruleIdFor = load("output/scan-formats.js").ruleIdFor;
-export const api34_findingSeverity = load("output/scan-formats.js").findingSeverity;
-export const api34_locationOf = load("output/scan-formats.js").locationOf;
-export const api34_fileUri = load("output/scan-formats.js").fileUri;
-export const api34_sarifPieces = load("output/scan-formats.js").sarifPieces;
-export const api34_escapeData = load("output/scan-formats.js").escapeData;
-export const api34_escapeProperty = load("output/scan-formats.js").escapeProperty;
-export const api34_githubLines = load("output/scan-formats.js").githubLines;
-export const api34_SARIF_MAX_RESULTS = load("output/scan-formats.js").SARIF_MAX_RESULTS;
-export const api35_withProcessErrorContext = load("process-error-context.js").withProcessErrorContext;
-export const api35_markMutationSent = load("process-error-context.js").markMutationSent;
-export const api35_internalErrorMessage = load("process-error-context.js").internalErrorMessage;
-export const api36_isProtectedPath = load("protected-path.js").isProtectedPath;
-export const api36_resolveUnprotectedPath = load("protected-path.js").resolveUnprotectedPath;
-export const api37_openRegistry = load("registry/index.js").openRegistry;
-export const api37_replacementProblem = load("registry/index.js").replacementProblem;
-export const api37_replacementLinkProblems = load("registry/index.js").replacementLinkProblems;
-export const api37_hasCustomCaveat = load("registry/index.js").hasCustomCaveat;
-export const api37_RegistryInputError = load("registry/index.js").RegistryInputError;
-export const api37_RegistryUsageError = load("registry/index.js").RegistryUsageError;
-export const api37_Registry = load("registry/index.js").Registry;
-export const api38_validDomain = load("registry/process-domain.js").validDomain;
-export const api38_ownProcessDomain = load("registry/process-domain.js").ownProcessDomain;
-export const api39_buildAccessReview = load("report/access-review.js").buildAccessReview;
-export const api39_csvField = load("report/access-review.js").csvField;
-export const api39_formatAccessReview = load("report/access-review.js").formatAccessReview;
-export const api39_REPORT_FORMATS = load("report/access-review.js").REPORT_FORMATS;
-export const api39_LIMITATIONS = load("report/access-review.js").LIMITATIONS;
-export const api40_agentConfigCandidates = load("scan/agent-configs.js").agentConfigCandidates;
-export const api40_discoverAgentConfigs = load("scan/agent-configs.js").discoverAgentConfigs;
-export const api40_defaultAgentConfigEnvironment = load("scan/agent-configs.js").defaultAgentConfigEnvironment;
-export const api41_nonLocalPath = load("scan/git-history.js").nonLocalPath;
-export const api41_locateRepository = load("scan/git-history.js").locateRepository;
-export const api41_gitEnvironment = load("scan/git-history.js").gitEnvironment;
-export const api41_assertWorkTree = load("scan/git-history.js").assertWorkTree;
-export const api41_isShallowRepository = load("scan/git-history.js").isShallowRepository;
-export const api41_historyEntries = load("scan/git-history.js").historyEntries;
-export const api41_blobSizes = load("scan/git-history.js").blobSizes;
-export const api41_readBlobs = load("scan/git-history.js").readBlobs;
-export const api41_GitHistoryError = load("scan/git-history.js").GitHistoryError;
-export const api41_MODE_REGULAR = load("scan/git-history.js").MODE_REGULAR;
-export const api41_MODE_SYMLINK = load("scan/git-history.js").MODE_SYMLINK;
-export const api41_MODE_OTHER = load("scan/git-history.js").MODE_OTHER;
-export const api41_GIT_IDLE_TIMEOUT_MS = load("scan/git-history.js").GIT_IDLE_TIMEOUT_MS;
-export const api41_MAX_HISTORY_ENTRIES = load("scan/git-history.js").MAX_HISTORY_ENTRIES;
-export const api41_PINNED_CONFIG = load("scan/git-history.js").PINNED_CONFIG;
-export const api41_PREFLIGHT_LIMITS = load("scan/git-history.js").PREFLIGHT_LIMITS;
-export const api42_parseIgnoreFile = load("scan/ignore.js").parseIgnoreFile;
-export const api42_IgnoreFileError = load("scan/ignore.js").IgnoreFileError;
-export const api43_scan = load("scan/index.js").scan;
-export const api43_IgnoreFileError = load("scan/index.js").IgnoreFileError;
-export const api43_GitHistoryError = load("scan/index.js").GitHistoryError;
-export const api43_FINDINGS_LIMIT = load("scan/index.js").FINDINGS_LIMIT;
-export const api43_ALSO_AT_EXAMPLES = load("scan/index.js").ALSO_AT_EXAMPLES;
-export const api43_HISTORY_DEDUP_WORK_LIMIT = load("scan/index.js").HISTORY_DEDUP_WORK_LIMIT;
-export const api43_FindingsLimitError = load("scan/index.js").FindingsLimitError;
-export const api43_SCAN_CONCURRENCY = load("scan/index.js").SCAN_CONCURRENCY;
-export const api43_readBounded = load("scan/index.js").readBounded;
-export const api44_mcpServerStringSpans = load("scan/mcp-context.js").mcpServerStringSpans;
-export const api44_withinSpans = load("scan/mcp-context.js").withinSpans;
-export const api44_MAX_DEPTH = load("scan/mcp-context.js").MAX_DEPTH;
-export const api45_nwcMatches = load("scan/nwc-match.js").nwcMatches;
-export const api45_replaceNwc = load("scan/nwc-match.js").replaceNwc;
-export const api45_nwcUnescaped = load("scan/nwc-match.js").nwcUnescaped;
-export const api46_macaroonHex = load("scan/patterns.js").macaroonHex;
-export const api46_macaroonBase64 = load("scan/patterns.js").macaroonBase64;
-export const api46_lndconnect = load("scan/patterns.js").lndconnect;
-export const api46_nwc = load("scan/patterns.js").nwc;
-export const api47_redactDecoded = load("scan/redact.js").redactDecoded;
-export const api47_redactPath = load("scan/redact.js").redactPath;
-export const api47_collectNwcSecrets = load("scan/redact.js").collectNwcSecrets;
-export const api47_knownSecretRedactor = load("scan/redact.js").knownSecretRedactor;
-export const api47_redactKnownSecrets = load("scan/redact.js").redactKnownSecrets;
-export const api48_Secret = load("secret.js").Secret;
-export const api49_macwardenVersion = load("version.js").macwardenVersion;
-export const api50_createAlertThrottle = load("watch/alert-throttle.js").createAlertThrottle;
-export const api50_createAlertRunner = load("watch/alert-throttle.js").createAlertRunner;
-export const api50_ALERT_WINDOW_MS = load("watch/alert-throttle.js").ALERT_WINDOW_MS;
-export const api50_MAX_TRACKED_CANARIES = load("watch/alert-throttle.js").MAX_TRACKED_CANARIES;
-export const api51_reapAlertGroups = load("watch/alert.js").reapAlertGroups;
-export const api51_alertCleanupDone = load("watch/alert.js").alertCleanupDone;
-export const api51_runAlertCommand = load("watch/alert.js").runAlertCommand;
-export const api51_ALERT_TIMEOUT_MS = load("watch/alert.js").ALERT_TIMEOUT_MS;
-export const api51_ALERT_KILL_MS = load("watch/alert.js").ALERT_KILL_MS;
-export const api51_ALERT_GRACE_MS = load("watch/alert.js").ALERT_GRACE_MS;
-export const api51_ALERT_CLEANUP_MS = load("watch/alert.js").ALERT_CLEANUP_MS;
-export const api52_canaryConfigPath = load("watch/canary.js").canaryConfigPath;
-export const api52_newCaveatName = load("watch/canary.js").newCaveatName;
-export const api52_newCondition = load("watch/canary.js").newCondition;
-export const api52_canaryCondition = load("watch/canary.js").canaryCondition;
-export const api52_readCanaryConfig = load("watch/canary.js").readCanaryConfig;
-export const api52_ensureCanaryConfig = load("watch/canary.js").ensureCanaryConfig;
-export const api52_canaryEntries = load("watch/canary.js").canaryEntries;
-export const api52_isCanary = load("watch/canary.js").isCanary;
-export const api52_CANARY_FILE_LIMIT = load("watch/canary.js").CANARY_FILE_LIMIT;
-export const api53_retryable = load("watch/output-queue.js").retryable;
-export const api53_fdWriter = load("watch/output-queue.js").fdWriter;
-export const api53_createOutputQueue = load("watch/output-queue.js").createOutputQueue;
-export const api53_OUTPUT_LIMIT_BYTES = load("watch/output-queue.js").OUTPUT_LIMIT_BYTES;
-export const api54_usagePath = load("watch/usage.js").usagePath;
-export const api54_readUsage = load("watch/usage.js").readUsage;
-export const api54_writeUsage = load("watch/usage.js").writeUsage;
-export const api54_USAGE_LIMIT = load("watch/usage.js").USAGE_LIMIT;
-export const api54_CANARY_LIMIT = load("watch/usage.js").CANARY_LIMIT;
-export const api54_COVERAGE_LIMIT = load("watch/usage.js").COVERAGE_LIMIT;
-export const api54_SPAN_LIMIT = load("watch/usage.js").SPAN_LIMIT;
-export const api54_USAGE_FILE_LIMIT = load("watch/usage.js").USAGE_FILE_LIMIT;
-export const api54_UsageFileError = load("watch/usage.js").UsageFileError;
-export const api54_UsageStore = load("watch/usage.js").UsageStore;
+export const api8_reserveFailure = load("commands/bake/out-errors.js").reserveFailure;
+export const api8_OutputReserveError = load("commands/bake/out-errors.js").OutputReserveError;
+export const api9_reserveOut = load("commands/bake/write-out.js").reserveOut;
+export const api10_handlers = load("commands/handlers.js").handlers;
+export const api11_inspectResult = load("commands/inspect.js").inspectResult;
+export const api11_run = load("commands/inspect.js").run;
+export const api11_inspect = load("commands/inspect.js").inspect;
+export const api12_run = load("commands/inventory.js").run;
+export const api12_inventory = load("commands/inventory.js").inventory;
+export const api13_narrowLabel = load("commands/recommend.js").narrowLabel;
+export const api13_run = load("commands/recommend.js").run;
+export const api13_recommend = load("commands/recommend.js").recommend;
+export const api13_SHORT_OBSERVATION_SECONDS = load("commands/recommend.js").SHORT_OBSERVATION_SECONDS;
+export const api14_aggregateExit = load("commands/respond.js").aggregateExit;
+export const api14_run = load("commands/respond.js").run;
+export const api14_respond = load("commands/respond.js").respond;
+export const api14_ROOT_KEY_0_GUIDANCE = load("commands/respond.js").ROOT_KEY_0_GUIDANCE;
+export const api14_OWN_ON_ROOT_KEY_0 = load("commands/respond.js").OWN_ON_ROOT_KEY_0;
+export const api14_REVOKED_BUT_PRESENT_GUIDANCE = load("commands/respond.js").REVOKED_BUT_PRESENT_GUIDANCE;
+export const api14_BAKING_RISK_GUIDANCE = load("commands/respond.js").BAKING_RISK_GUIDANCE;
+export const api14_CUSTOM_CAVEAT_NOTE = load("commands/respond.js").CUSTOM_CAVEAT_NOTE;
+export const api14_UNKNOWN_GUIDANCE = load("commands/respond.js").UNKNOWN_GUIDANCE;
+export const api15_run = load("commands/revoke.js").run;
+export const api15_revoke = load("commands/revoke.js").revoke;
+export const api16_run = load("commands/rotate.js").run;
+export const api16_rotate = load("commands/rotate.js").rotate;
+export const api17_run = load("commands/scan.js").run;
+export const api18_run = load("commands/verify.js").run;
+export const api18_verify = load("commands/verify.js").verify;
+export const api18_ROOT_KEY_0_ACCEPTED = load("commands/verify.js").ROOT_KEY_0_ACCEPTED;
+export const api18_CAN_BAKE_ACCEPTED = load("commands/verify.js").CAN_BAKE_ACCEPTED;
+export const api18_CAN_BAKE_ROOT_KEY_0 = load("commands/verify.js").CAN_BAKE_ROOT_KEY_0;
+export const api18_OWN_ROOT_KEY_ACCEPTED = load("commands/verify.js").OWN_ROOT_KEY_ACCEPTED;
+export const api18_REJECTED_INCONCLUSIVE = load("commands/verify.js").REJECTED_INCONCLUSIVE;
+export const api18_LOCAL_EXPIRY_UNCONFIRMED = load("commands/verify.js").LOCAL_EXPIRY_UNCONFIRMED;
+export const api18_SIGNATURE_MISMATCH_INCONCLUSIVE = load("commands/verify.js").SIGNATURE_MISMATCH_INCONCLUSIVE;
+export const api18_SIGNATURE_MISMATCH_HOW_TO_CONCLUDE = load("commands/verify.js").SIGNATURE_MISMATCH_HOW_TO_CONCLUDE;
+export const api18_SIGNATURE_MISMATCH_ROOT_KEY_0 = load("commands/verify.js").SIGNATURE_MISMATCH_ROOT_KEY_0;
+export const api18_OWN_ROOT_KEY_INCONCLUSIVE = load("commands/verify.js").OWN_ROOT_KEY_INCONCLUSIVE;
+export const api18_ROOT_KEY_0_INCONCLUSIVE = load("commands/verify.js").ROOT_KEY_0_INCONCLUSIVE;
+export const api18_CUSTOM_CAVEAT_REJECTED = load("commands/verify.js").CUSTOM_CAVEAT_REJECTED;
+export const api19_scheduleDeadline = load("commands/watch.js").scheduleDeadline;
+export const api19_lockOwnerGone = load("commands/watch.js").lockOwnerGone;
+export const api19_acquireLock = load("commands/watch.js").acquireLock;
+export const api19_run = load("commands/watch.js").run;
+export const api19_stdoutEvents = load("commands/watch.js").stdoutEvents;
+export const api19_watch = load("commands/watch.js").watch;
+export const api19_CANARY_RELOAD_MS = load("commands/watch.js").CANARY_RELOAD_MS;
+export const api19_MAX_TIMER_MS = load("commands/watch.js").MAX_TIMER_MS;
+export const api20_redactEncodedCredentials = load("credential-recognition.js").redactEncodedCredentials;
+export const api21_macaroonEosEnd = load("decode/index.js").macaroonEosEnd;
+export const api21_macaroonPacketRange = load("decode/index.js").macaroonPacketRange;
+export const api21_macaroonSectionRange = load("decode/index.js").macaroonSectionRange;
+export const api21_parseTimeBefore = load("decode/index.js").parseTimeBefore;
+export const api21_canonicalMacaroonForm = load("decode/index.js").canonicalMacaroonForm;
+export const api21_decodeMacaroon = load("decode/index.js").decodeMacaroon;
+export const api21_macaroonId = load("decode/index.js").macaroonId;
+export const api21_encodeMacaroon = load("decode/index.js").encodeMacaroon;
+export const api21_addFirstPartyCaveat = load("decode/index.js").addFirstPartyCaveat;
+export const api21_timeBeforeCondition = load("decode/index.js").timeBeforeCondition;
+export const api21_validMacaroonIdentifier = load("decode/index.js").validMacaroonIdentifier;
+export const api21_isNwcContainer = load("decode/index.js").isNwcContainer;
+export const api21_decodeNwc = load("decode/index.js").decodeNwc;
+export const api21_DecodeError = load("decode/index.js").DecodeError;
+export const api22_macaroonEnds = load("decode/recognition.js").macaroonEnds;
+export const api23_unsafeNodeDiagnostics = load("environment.js").unsafeNodeDiagnostics;
+export const api24_UsageError = load("errors.js").UsageError;
+export const api24_InputError = load("errors.js").InputError;
+export const api24_DecodeError = load("errors.js").DecodeError;
+export const api24_LndError = load("errors.js").LndError;
+export const api24_LndUncertainError = load("errors.js").LndUncertainError;
+export const api25_grade = load("grade/index.js").grade;
+export const api25_gradeFacts = load("grade/index.js").gradeFacts;
+export const api25_describe = load("grade/index.js").describe;
+export const api25_canBake = load("grade/index.js").canBake;
+export const api25_BAKE_MACAROON_URI = load("grade/index.js").BAKE_MACAROON_URI;
+export const api26_groupedRuns = load("grouped-runs.js").groupedRuns;
+export const api26_groupedBase64 = load("grouped-runs.js").groupedBase64;
+export const api27_readCredential = load("input/index.js").readCredential;
+export const api27_InputError = load("input/index.js").InputError;
+export const api27_UsageError = load("input/index.js").UsageError;
+export const api28_parseLndconnect = load("input/lndconnect.js").parseLndconnect;
+export const api29_isInstant = load("instant.js").isInstant;
+export const api30_openGrpcStream = load("lnd/grpc.js").openGrpcStream;
+export const api30_MAX_GRPC_MESSAGE = load("lnd/grpc.js").MAX_GRPC_MESSAGE;
+export const api30_STALL_TIMEOUT_MS = load("lnd/grpc.js").STALL_TIMEOUT_MS;
+export const api30_MAX_PENDING_WRITE_BYTES = load("lnd/grpc.js").MAX_PENDING_WRITE_BYTES;
+export const api30_WRITE_OVERHEAD_BYTES = load("lnd/grpc.js").WRITE_OVERHEAD_BYTES;
+export const api30_PING_INTERVAL_MS = load("lnd/grpc.js").PING_INTERVAL_MS;
+export const api30_PING_TIMEOUT_MS = load("lnd/grpc.js").PING_TIMEOUT_MS;
+export const api31_createLndAdapter = load("lnd/index.js").createLndAdapter;
+export const api31_registerMiddleware = load("lnd/index.js").registerMiddleware;
+export const api32_decodeMiddlewareRequest = load("lnd/middleware-proto.js").decodeMiddlewareRequest;
+export const api32_encodeRegistration = load("lnd/middleware-proto.js").encodeRegistration;
+export const api32_encodeFeedback = load("lnd/middleware-proto.js").encodeFeedback;
+export const api32_MAX_MACAROON_BYTES = load("lnd/middleware-proto.js").MAX_MACAROON_BYTES;
+export const api32_MAX_METHOD_BYTES = load("lnd/middleware-proto.js").MAX_METHOD_BYTES;
+export const api32_MAX_CONDITION_BYTES = load("lnd/middleware-proto.js").MAX_CONDITION_BYTES;
+export const api32_UNKNOWN_METHOD = load("lnd/middleware-proto.js").UNKNOWN_METHOD;
+export const api33_identityCheck = load("lnd/tls-identity.js").identityCheck;
+export const api34_endpoint = load("online.js").endpoint;
+export const api34_credentialText = load("online.js").credentialText;
+export const api34_connectionProblem = load("online.js").connectionProblem;
+export const api34_connectionSettings = load("online.js").connectionSettings;
+export const api34_flagProblem = load("online.js").flagProblem;
+export const api34_nodeInfo = load("online.js").nodeInfo;
+export const api34_nodePubkey = load("online.js").nodePubkey;
+export const api34_drift = load("online.js").drift;
+export const api34_samePermissions = load("online.js").samePermissions;
+export const api34_listIds = load("online.js").listIds;
+export const api34_failureDetails = load("online.js").failureDetails;
+export const api34_onlineAdapter = load("online.js").onlineAdapter;
+export const api34_shellQuote = load("online.js").shellQuote;
+export const api34_recoveryPath = load("online.js").recoveryPath;
+export const api34_recoveryCommand = load("online.js").recoveryCommand;
+export const api34_inventoryRecoveryCommand = load("online.js").inventoryRecoveryCommand;
+export const api34_readOnlineCredential = load("online.js").readOnlineCredential;
+export const api34_onlineWarnings = load("online.js").onlineWarnings;
+export const api34_LABEL_RULE = load("online.js").LABEL_RULE;
+export const api34_readBoundedFile = load("online.js").readBoundedFile;
+export const api35_rotatePlanResult = load("output/index.js").rotatePlanResult;
+export const api35_revokePlanResult = load("output/index.js").revokePlanResult;
+export const api35_error = load("output/index.js").error;
+export const api35_warning = load("output/index.js").warning;
+export const api35_renderWatchEvent = load("output/index.js").renderWatchEvent;
+export const api35_formatDuration = load("output/index.js").formatDuration;
+export const api35_revokeConfirmation = load("output/index.js").revokeConfirmation;
+export const api35_writeRevokePrompt = load("output/index.js").writeRevokePrompt;
+export const api35_writeRotateFinishPlan = load("output/index.js").writeRotateFinishPlan;
+export const api35_rotateConfirmation = load("output/index.js").rotateConfirmation;
+export const api35_writeRotatePrompt = load("output/index.js").writeRotatePrompt;
+export const api35_render = load("output/index.js").render;
+export const api35_renderChunks = load("output/index.js").renderChunks;
+export const api35_inventoryResult = load("output/index.js").inventoryResult;
+export const api35_writeRotateStagePlan = load("output/index.js").writeRotateStagePlan;
+export const api36_ruleIdFor = load("output/scan-formats.js").ruleIdFor;
+export const api36_findingSeverity = load("output/scan-formats.js").findingSeverity;
+export const api36_locationOf = load("output/scan-formats.js").locationOf;
+export const api36_fileUri = load("output/scan-formats.js").fileUri;
+export const api36_sarifPieces = load("output/scan-formats.js").sarifPieces;
+export const api36_escapeData = load("output/scan-formats.js").escapeData;
+export const api36_escapeProperty = load("output/scan-formats.js").escapeProperty;
+export const api36_githubLines = load("output/scan-formats.js").githubLines;
+export const api36_SARIF_MAX_RESULTS = load("output/scan-formats.js").SARIF_MAX_RESULTS;
+export const api37_withProcessErrorContext = load("process-error-context.js").withProcessErrorContext;
+export const api37_markMutationSent = load("process-error-context.js").markMutationSent;
+export const api37_internalErrorMessage = load("process-error-context.js").internalErrorMessage;
+export const api38_isProtectedPath = load("protected-path.js").isProtectedPath;
+export const api38_outputNameProblem = load("protected-path.js").outputNameProblem;
+export const api38_resolveUnprotectedPath = load("protected-path.js").resolveUnprotectedPath;
+export const api39_openRegistry = load("registry/index.js").openRegistry;
+export const api39_replacementProblem = load("registry/index.js").replacementProblem;
+export const api39_replacementLinkProblems = load("registry/index.js").replacementLinkProblems;
+export const api39_recordedFileRelation = load("registry/index.js").recordedFileRelation;
+export const api39_isStagedReplacement = load("registry/index.js").isStagedReplacement;
+export const api39_hasCustomCaveat = load("registry/index.js").hasCustomCaveat;
+export const api39_RegistryInputError = load("registry/index.js").RegistryInputError;
+export const api39_RegistryUsageError = load("registry/index.js").RegistryUsageError;
+export const api39_Registry = load("registry/index.js").Registry;
+export const api40_validDomain = load("registry/process-domain.js").validDomain;
+export const api40_ownProcessDomain = load("registry/process-domain.js").ownProcessDomain;
+export const api41_buildAccessReview = load("report/access-review.js").buildAccessReview;
+export const api41_csvField = load("report/access-review.js").csvField;
+export const api41_formatAccessReview = load("report/access-review.js").formatAccessReview;
+export const api41_REPORT_FORMATS = load("report/access-review.js").REPORT_FORMATS;
+export const api41_LIMITATIONS = load("report/access-review.js").LIMITATIONS;
+export const api42_isRootKeyId = load("root-key-id.js").isRootKeyId;
+export const api42_MAX_ROOT_KEY_ID = load("root-key-id.js").MAX_ROOT_KEY_ID;
+export const api43_agentConfigCandidates = load("scan/agent-configs.js").agentConfigCandidates;
+export const api43_discoverAgentConfigs = load("scan/agent-configs.js").discoverAgentConfigs;
+export const api43_defaultAgentConfigEnvironment = load("scan/agent-configs.js").defaultAgentConfigEnvironment;
+export const api44_nonLocalPath = load("scan/git-history.js").nonLocalPath;
+export const api44_locateRepository = load("scan/git-history.js").locateRepository;
+export const api44_gitEnvironment = load("scan/git-history.js").gitEnvironment;
+export const api44_assertWorkTree = load("scan/git-history.js").assertWorkTree;
+export const api44_isShallowRepository = load("scan/git-history.js").isShallowRepository;
+export const api44_historyEntries = load("scan/git-history.js").historyEntries;
+export const api44_blobSizes = load("scan/git-history.js").blobSizes;
+export const api44_readBlobs = load("scan/git-history.js").readBlobs;
+export const api44_GitHistoryError = load("scan/git-history.js").GitHistoryError;
+export const api44_MODE_REGULAR = load("scan/git-history.js").MODE_REGULAR;
+export const api44_MODE_SYMLINK = load("scan/git-history.js").MODE_SYMLINK;
+export const api44_MODE_OTHER = load("scan/git-history.js").MODE_OTHER;
+export const api44_GIT_IDLE_TIMEOUT_MS = load("scan/git-history.js").GIT_IDLE_TIMEOUT_MS;
+export const api44_MAX_HISTORY_ENTRIES = load("scan/git-history.js").MAX_HISTORY_ENTRIES;
+export const api44_PINNED_CONFIG = load("scan/git-history.js").PINNED_CONFIG;
+export const api44_PREFLIGHT_LIMITS = load("scan/git-history.js").PREFLIGHT_LIMITS;
+export const api45_parseIgnoreFile = load("scan/ignore.js").parseIgnoreFile;
+export const api45_IgnoreFileError = load("scan/ignore.js").IgnoreFileError;
+export const api46_scan = load("scan/index.js").scan;
+export const api46_IgnoreFileError = load("scan/index.js").IgnoreFileError;
+export const api46_GitHistoryError = load("scan/index.js").GitHistoryError;
+export const api46_CANDIDATE_LIMIT = load("scan/index.js").CANDIDATE_LIMIT;
+export const api46_FINDINGS_LIMIT = load("scan/index.js").FINDINGS_LIMIT;
+export const api46_ALSO_AT_EXAMPLES = load("scan/index.js").ALSO_AT_EXAMPLES;
+export const api46_HISTORY_DEDUP_WORK_LIMIT = load("scan/index.js").HISTORY_DEDUP_WORK_LIMIT;
+export const api46_FindingsLimitError = load("scan/index.js").FindingsLimitError;
+export const api46_SCAN_CONCURRENCY = load("scan/index.js").SCAN_CONCURRENCY;
+export const api46_readBounded = load("scan/index.js").readBounded;
+export const api46_SCAN_OPEN_FLAGS = load("scan/index.js").SCAN_OPEN_FLAGS;
+export const api47_mcpServerStringSpans = load("scan/mcp-context.js").mcpServerStringSpans;
+export const api47_withinSpans = load("scan/mcp-context.js").withinSpans;
+export const api47_MAX_DEPTH = load("scan/mcp-context.js").MAX_DEPTH;
+export const api48_nwcMatches = load("scan/nwc-match.js").nwcMatches;
+export const api48_replaceNwc = load("scan/nwc-match.js").replaceNwc;
+export const api48_nwcUnescaped = load("scan/nwc-match.js").nwcUnescaped;
+export const api49_macaroonHex = load("scan/patterns.js").macaroonHex;
+export const api49_macaroonBase64 = load("scan/patterns.js").macaroonBase64;
+export const api49_lndconnect = load("scan/patterns.js").lndconnect;
+export const api49_nwc = load("scan/patterns.js").nwc;
+export const api50_redactDecoded = load("scan/redact.js").redactDecoded;
+export const api50_redactPath = load("scan/redact.js").redactPath;
+export const api50_collectNwcSecrets = load("scan/redact.js").collectNwcSecrets;
+export const api50_knownSecretRedactor = load("scan/redact.js").knownSecretRedactor;
+export const api50_redactKnownSecrets = load("scan/redact.js").redactKnownSecrets;
+export const api51_Secret = load("secret.js").Secret;
+export const api52_macwardenVersion = load("version.js").macwardenVersion;
+export const api53_createAlertThrottle = load("watch/alert-throttle.js").createAlertThrottle;
+export const api53_createAlertRunner = load("watch/alert-throttle.js").createAlertRunner;
+export const api53_ALERT_WINDOW_MS = load("watch/alert-throttle.js").ALERT_WINDOW_MS;
+export const api53_MAX_TRACKED_CANARIES = load("watch/alert-throttle.js").MAX_TRACKED_CANARIES;
+export const api54_reapAlertGroups = load("watch/alert.js").reapAlertGroups;
+export const api54_alertCleanupDone = load("watch/alert.js").alertCleanupDone;
+export const api54_runAlertCommand = load("watch/alert.js").runAlertCommand;
+export const api54_ALERT_TIMEOUT_MS = load("watch/alert.js").ALERT_TIMEOUT_MS;
+export const api54_ALERT_KILL_MS = load("watch/alert.js").ALERT_KILL_MS;
+export const api54_ALERT_GRACE_MS = load("watch/alert.js").ALERT_GRACE_MS;
+export const api54_ALERT_CLEANUP_MS = load("watch/alert.js").ALERT_CLEANUP_MS;
+export const api55_canaryConfigPath = load("watch/canary.js").canaryConfigPath;
+export const api55_newCaveatName = load("watch/canary.js").newCaveatName;
+export const api55_newCondition = load("watch/canary.js").newCondition;
+export const api55_canaryCondition = load("watch/canary.js").canaryCondition;
+export const api55_readCanaryConfig = load("watch/canary.js").readCanaryConfig;
+export const api55_ensureCanaryConfig = load("watch/canary.js").ensureCanaryConfig;
+export const api55_canaryEntries = load("watch/canary.js").canaryEntries;
+export const api55_isCanary = load("watch/canary.js").isCanary;
+export const api55_CANARY_FILE_LIMIT = load("watch/canary.js").CANARY_FILE_LIMIT;
+export const api56_retryable = load("watch/output-queue.js").retryable;
+export const api56_fdWriter = load("watch/output-queue.js").fdWriter;
+export const api56_createOutputQueue = load("watch/output-queue.js").createOutputQueue;
+export const api56_OUTPUT_LIMIT_BYTES = load("watch/output-queue.js").OUTPUT_LIMIT_BYTES;
+export const api57_usagePath = load("watch/usage.js").usagePath;
+export const api57_readUsage = load("watch/usage.js").readUsage;
+export const api57_writeUsage = load("watch/usage.js").writeUsage;
+export const api57_USAGE_LIMIT = load("watch/usage.js").USAGE_LIMIT;
+export const api57_CANARY_LIMIT = load("watch/usage.js").CANARY_LIMIT;
+export const api57_COVERAGE_LIMIT = load("watch/usage.js").COVERAGE_LIMIT;
+export const api57_SPAN_LIMIT = load("watch/usage.js").SPAN_LIMIT;
+export const api57_USAGE_FILE_LIMIT = load("watch/usage.js").USAGE_FILE_LIMIT;
+export const api57_UsageFileError = load("watch/usage.js").UsageFileError;
+export const api57_UsageStore = load("watch/usage.js").UsageStore;